Otherwise https only gurantees that you're actually talking to the domain you see in the URL, not who that domain belongs to.