But it doesn't matter if it's client side only: * It might not be in future * It's not using SSL, so anybody in between can make it stop being client side onl

But it doesn't matter if it's client side only: * It might not be in future * It's not using SSL, so anybody in between can make it stop being client side only whenever they like * It's a terrible, terrible idea to teach users to trust things like this.