The very first thing the Commerce Stripe module states is this:
As of the implementation of PCI-DSS 3.0 (January 2015), this module is intended to work within the requirements of the Self Assessment Questionnaire A-EP. If you are not familiar with the requirements of SAQ A-EP, which includes a wide range of security practices as well as quarterly penetration scans by a PCI certified third party vendor, you should not use this module.
However later on it says
PCI-compliant integration/payments. Utilizes the stripe.js library so that sensitive card data never touches your server.
The Commerce Paypal page makes no mention of PCI-DSS. If card data never touches my server what changes do I need to make? Do I need an SSL cert?