[Karunamon]

Sites and content we consider ‘archival’ that involve no signing in or personalisation,

AUGH! Seeing this "SSL is just for private things" mindset in 2016 is really disheartening. It's to keep people from screwing with your connection, not just snooping on it.

I really hope the browser vendors start treating HTTP the same way they treat broken certs sometime soon. This will change once users start asking, en masse, "Why am I getting all these warnings", not before.

[wanda]

Pretty sure a diluted form of the broken cert treatment for HTTP is available behind a flag in Chrome, so it might be in the pipeline.

Source: http://peter.sh/experiments/chromium-command-line-switches/

See:

    --mark-insecure-as