Is online shopping security fundamentally broken?

Pretty much every website handling financial transactions uses a certificate-based trust model. They use signed SSL certificates from a public certificate authority within a cryptographic signing infrastructure - or to put it another way, you trust them because your browser doesn't tell you not to.