True, hidden passwords does not mean they are encrypted.
Not true that the SSL certificate encrypts the communication. SSL, or Secure Socket Layer, does not require a certificate to be functional. I have set up many, many secure websites without ever having installed a certificate. The connection is still secure/encrypted, but the visitor to that website will receive a warning that it may not be the webpage they think it is. The certificate is the assurance by the cert provider that the website is the actual site it claims to be. The private/public keys can only be used on that website, thus the assurance.
My webserver, for example, throws up a warning whenever to go to sign in. I disregard the warning because I know it's the correct website and I know that the information being passed is encrypted. If I went to an only store, for instance, that warning would tell me that it "might" not be the website I think it is, because they do not have the proper certificate.