This is part of strategy known as "Defense in Depth." Each layer does not presume that the layers before or after it are certain to be secure, and takes measures to ensure security and verify security. HMAC signatures are one of those measures.
A HMAC signature preserves the integrity of the query so that a 0.1BTC purchase doesn't get changed to a 1.0BTC regardless of the security of the HTTPS transport.
The protections granted by SSL/HTTPS/TLS are not absolute and do have some clever attacks. In addition to some non-clever attacks such as the private key of the other side of the transaction being known to some third party (either by malice, hackers, or force of law). The same goes for other parameters needed for the integrity of the communication. There have been experimental Man in the Middle attacks where SSL transactions have been altered. The math wasn't broken, but other clever configuration changes were done. So the weak link there is people.