If you control the device and binaries then you will always be one step above everyone else. If someone was dumb enough to use HTTP and just switched to HTTPS,

If you control the device and binaries then you will always be one step above everyone else. If someone was dumb enough to use HTTP and just switched to HTTPS, I'm 99.9999% sure they won't check what certificate is being used and you can just use something like Telerik Fiddler to do HTTPS MITM with a custom generated root CA, you'll be surprised how easy it is to get those installed even in phones.