And the even more sinister "include a malware payload into an asset which was requested". Drive-by infection of exe's, injecting video streams with payloads tha

And the even more sinister "include a malware payload into an asset which was requested". Drive-by infection of exe's, injecting video streams with payloads that can take advantage of the StageFright vulnerability, not to mention things like session hijacking that can happen if any part of a page is loaded over http. HTTPS is all or nothing, an in-between "only on the pages that need it" isn't going to cut it. This is just the chrome team's first step (actually more like 5th or 6th step in this plan) toward getting there.