> But post Snowden, and particularly after the result of the last election here in the US, it's clear that everything on the web should be encrypted by default.

> But post Snowden, and particularly after the result of the last election here in the US, it's clear that everything on the web should be encrypted by default. I agree, however, https only barely protects against this, as state actors can easily get a hold of a root cert. You need key pinning if you really want to stop a state from reading your plain text traffic, and even then, traffic analysis and metadata are often enough for them.