As it turns out, Google does serve the script with SSL at https://www.google-analytics.com/ga.js https://www.google-analytics.com/ga.js if you request it. So, /

As it turns out, Google does serve the script with SSL at https://www.google-analytics.com/ga.js https://www.google-analytics.com/ga.js if you request it. So, //www.google-analytics.com/ga.js works.