A long time ago I suggested a new uri prefix - "secure://" - that would be a synonym for "HTTPS-only". If you visit a secure:// link, every single page load in

A long time ago I suggested a new uri prefix - "secure://" - that would be a synonym for "HTTPS-only". If you visit a secure:// link, every single page load in the session would require strong encryption, secure cookies, etc. The idea was to allow http if needed, and alternately allow strict https if needed, in a backwards compatible way (visiting a https:// https:// url would work as before, but visiting secure:// would trigger the strict security for the rest of the session). This way you have the best of both worlds and the user (and server) get choice/agency. The purpose was to stop MITM. The ability to MITM only requires blocking port 443 and letting the browser fall back to 80; this works even against HSTS because most people will just try other URLs until one works. So you need a way to avoid MITM at least for some specific requests. Banks, e-mail providers, etc would say "type in secure://mybank.com in your browser for strong security". Another option was a "secure only" button on the browser. It seems they're moving towards this. They've buried it in preferences, which hopefully they'll change to the front UI. But I still think the secure:// links are easier for laypeople.