Yes, that is what you should do. The problem is that they don't do that. No harm in also running HTTPS on top of that as you can renew the TLS certificate with

Yes, that is what you should do. The problem is that they don't do that. No harm in also running HTTPS on top of that as you can renew the TLS certificate without issue.