> First, Firefox (and some others) are forcing TLS to use HTTP/2 : https://wiki.mozilla.org/Networking/http2 https://wiki.mozilla.org/Networking/http2 ; that's

> First, Firefox (and some others) are forcing TLS to use HTTP/2 : https://wiki.mozilla.org/Networking/http2 https://wiki.mozilla.org/Networking/http2 ; that's a big deal breaker for a lot of people. Yes, encryption is all well and good. I'll all for it! But SSL certs either cost money, or you get them from companies that will want cash to revoke them for you if compromised. I was against mandatory SSL for this very reason, until someone pointed out to me that SSL Encryption without Authentication would be a better default than no SSL at all. Basically, self signed certificates should be the lowest accepted request, and authenticated certificates would be the highest. If browsers showed the lock icon for authenticated certs (as they do now), and removed the big scary warnings for self-signed certs but don't show the lock, that's a much better default than what we have today.