The secret key that's supposed to prove a website is real, the thing behind that little padlock in your browser, turned out to be the number 4 at one company this week. Anyone who knew it could have faked your bank's website, your email login, pretty much any site you visit. And it wasn't even the scariest thing to happen online in the last four days. Here's how that works. A handful of companies called certificate authorities vouch that your bank's site really belongs to your bank. Their…