Yeah they don't _have to require SSL_ but I think we can agree that is a worse thing given the benefits of securing extensions and validation of the server host

Yeah they don't _have to require SSL_ but I think we can agree that is a worse thing given the benefits of securing extensions and validation of the server hosting them