Also, a dark cynical part of me wants to ask exactly what the business model behind "free" SSL certs is? You're not paying them, someone else is?

Well, you never give them your private key, so… what could they possibly do??