Can we really trust the browser padlock?

A rather worrying report from Sophos' Naked Security:

Can we really trust the browser padlock? Fake banking sites given TLS certificates

Quote:

In the meantime, this is one more nail in the coffin when it comes to being able to recognise a phishing URL by keeping an eye out for irregularities and mistakes.

I suppose it demonstrates how careful we need to be.

Can we really trust the browser padlock?