The problem with your analogy is that it downplays certain aspects and plays up others. Attacks on HTTP sites are known threats that we have evidence for, they

The problem with your analogy is that it downplays certain aspects and plays up others. Attacks on HTTP sites are known threats that we have evidence for, they aren't ridiculous or unheard of. The defense is not "everyone where a bulletproof vest", it's get a certificate and set up HTTPS - a one time cost that will protect thousands of people. You're making the choice for your users, who may not be as informed as you are, to not protect them. That's very different from asking them to wear a bulletproof vest.