[mholt]

> what about a news site that has no login/etc or a blog?

HTTPS. It's not just about privacy. You want people changing the content of your articles and injecting ads or malicious scripts for your visitors? As the owner of the site, you have a responsibility to protect them and protect yourself from liabilities.

Are you using the transport layer? Then you need Transport Layer Security.

> Should all those sites not benefit from the speed improvements that HTTP/2 offers?

So, nope. Not until they can guarantee integrity and authentication.