I would imagine it should be trivial to have the application automatically switch a user over to ssl when attempting to login, as a lot of applications do this.

I would imagine it should be trivial to have the application automatically switch a user over to ssl when attempting to login, as a lot of applications do this. Maybe it's PGs way of teaching people to think about security by making it something they need to "opt-in" to, but that seems like a fairly strange line in the sand to draw.