> a policy among browsers to trust self-signed certs if the only other option is HTTP I'm not arguing to remove warnings when going to a site with a self-signe

> a policy among browsers to trust self-signed certs if the only other option is HTTP I'm not arguing to remove warnings when going to a site with a self-signed cert. I'm arguing to add warnings to insecure HTTP until it's at least as scary as going to a site with a self-signed cert is today.