I think this is at the core of Google's thinking on this: unless presented with a negative, users' assumptions are that they're secure. Which is fair, given th

I think this is at the core of Google's thinking on this: unless presented with a negative, users' assumptions are that they're secure. Which is fair, given that I bet you'd get about a 5% or less recognition rate if you polled a random sampling of people on whether they could define "HTTPS" / "SSL" / "TLS" / "That lock thingie" to any degree of accuracy. A server shouldn't have the opportunity to serve an insecure connection to the user without the user being made explicitly aware of that fact.