Currently, the gravatar is fetched over http. This generates mixed content errors and causes the https to turn into an i instead of a lock. The error does not appear if for the profile page you select an https served image.