Thanks for the ideas.

I already have a self-signed cert I created awhile ago, and it's been working fine for my basic tests. I also bury my IMAP mail behind it using SquirrelMail, so the mod_ssl bits are already there and functioning well (I also use a similar certificate for my irc/ssl irc server). My server signature is currently:

Server:
   Apache/1.3.26 (Unix) 
   PHP/4.3.0RC1 
   mod_gzip/1.3.19.1a 
   mod_perl/1.26 
   mod_ssl/2.8.9 
   OpenSSL/0.9.6a
[download]

The only downside to having a self-signed certificate is that the user will get a warning dialog every single time they hit the secured page, because their browser doesn't recognize the CA.

I suppose I'll have to see how to handle the merchant account issue. I wonder what (if anything) they charge for that service. Is it a percentage of the charges processed through them? Or is it a flat fee on a monthly scale? Merits further investigation. Thanks again.