On the other hand, if it uses the OS HTTPS infrastructure, someone could probably add a root cert to IE and "MitM" themselves. If it doesn't, it's just a matter of finding and replacing the key; while that's not completely straightforward, it is done.

Darn, now it's really tempting to fire up some VMs. I don't have time for that.