You're absolutely right. While the typeform was served over https and stripe handled the CC, we should have been https from the start. It's fixed now.
Sorry! ~Earl