There is no downgrade. Mastodon will in it's default configuration not allow non-HTTPS connections. The protocol doesn't require it, so Mastodon technically doe

There is no downgrade. Mastodon will in it's default configuration not allow non-HTTPS connections. The protocol doesn't require it, so Mastodon technically doesn't. With a few code changes you can do that. So yes, Mastodon did know better but it's not an inherent property of ActivityPub to use HTTPS.