I think timbl has some good points here, but they're mixed in with FUD. Also, phasing out the https namespace is a bad an idea as moving everything to https. I

I think timbl has some good points here, but they're mixed in with FUD. Also, phasing out the https namespace is a bad an idea as moving everything to https. I think the best bet would be to allow TLS over port 80, call it http. Mark any sites that don't upgrade to TLS on port 80 as insecure, like unsigned certs are now. Allow unsigned certs on port 80. Enforce key pinning on port 80 and warn users when the pins don't match. Keep 443 for TLS with valid certs. This leaves port 80 as untrusted traffic and explicitly marks trivially exploited traffic as broken. It protects against many attacks as any http traffic that's MITMed will show up as being intercepted as long as it's not the first time the user makes that connection. https can stay as the secure one that non-technical users are trained to look for when they need security.