They just made aadhar mandatory for every school kid in Mumbai Maharashtra. Good luck to anyone who has to share share their childrens details on an insecure platform.
It's not like HTTPS would have helped much. It's an arbitrary IP address. How is a user supposed to verify an arbitrary IP address is not an attacker? This is what '.gov.in' is supposed to be for.
HTTP. FFS.