The argument that this person makes from what I can gather is I should not redirect people to https since their hosting company is not trustable by design of ho

The argument that this person makes from what I can gather is I should not redirect people to https since their hosting company is not trustable by design of holding said keys and second that who am I to impose encryption on others who should be aware of their own follies by using said compromised keys. This is a terrible post to make it on Hacker News as the straw men arguments here are exactly what harms individual users based on the ignorance of the service holder. Fine that this is his choice but also fine that browsers make it explicitly clear that the site being used is a potential security threat. Making excuses for why you should not have encryption based on your biases against the security itself because your provider "may" have access to your keys and you don't trust them is a bad excuse. If indeed you truly distrusted your provider than find another that is more trustworthy. If you cannot then you should self host but it doesn't get you off the hook from providing secure services to your users. In fact it puts you more on the hook for it. If you do not trust yourself which is what is also lumped in with the argument of not trusting VPS provider you have bigger problems and should probably not be participating in this eco system if you cannot trust yourself.