Exactly. It also breaks an existing, established security paradigm. If you want your users to actually properly practice some level of secure browsing, you ha

Exactly. It also breaks an existing, established security paradigm. If you want your users to actually properly practice some level of secure browsing, you have to keep the paradigms consistent. You can't expect the average user to adjust what cues they are looking for every six months, on a rolling basis. (Placing "locked padlock" graphics onto HTTP delivered pages is a good example of an abuse of such a paradigm. If your form is delivered by HTTP, it's trivial for a MITM to change the destination of its submission; making the form's destination URL HTTPS accomplishes nothing with respect to such a scenario.)