It's also easy to imagine what the blog posts would look like if they did the same thing except over TLS--in a way that the harmlessness / purpose of the reques

It's also easy to imagine what the blog posts would look like if they did the same thing except over TLS--in a way that the harmlessness / purpose of the request was not immediately apparent. I agree with you, though--it seems like they solved a valid problem with the most obvious, commonly-used solution. The real debate is probably just over whether or not the problem is a sufficiently large threat to justify the downsides.