It's hard to justify not having https on any site. Without it you are saying "you might get the intended HTML we sent ... or maybe not if the request has been i

It's hard to justify not having https on any site. Without it you are saying "you might get the intended HTML we sent ... or maybe not if the request has been intercepted". Any other encryption system is not natively supported by the browser so would require some kind of plug in. How would you download that plugin? https? Using JS to encrypt is a problem because you need to securely download that JS to begin with, requiring https or similar.