Maybe there is a bizzare reason why they don't use https on their ocsp endpoint. Perhaps they want to avoid situation where the ocsp server's certificate itself

Maybe there is a bizzare reason why they don't use https on their ocsp endpoint. Perhaps they want to avoid situation where the ocsp server's certificate itself is revoked, or anticipated that the ocsp server would still be in use 10 years later where the currently used crypto could have been marked as insecure and removed and thus prevent older clients from working. Or it could be laziness, but come on...