TLS Everywhere, not https: URIs (2015)
Users/user agents need to know whether to <i>expect</i> a connection to be secure. Unfortunately, you can't necessarily trust any random link you follow to reliably tell you. If I can get you to use HTTP when you should've used HTTPS, I might be able to sniff your traffic. If I can get you to use HTTPS when you should've used HTTP, it might be a DoS.<p>Incidentally, this is the same problem as public key distribution. You need a trusted channel to receive public keys, and a trusted channel to know whether to use a public key. Why can't these be the same channel? Right now we have HSTS preloading[1] for the latter, but in that case why not preload certificates (or hashes thereof) too?<p>Then we can finally cut out the middle-men and realize the truth: that the browser is the ultimate certificate authority.<p>[1] <a href="https://hstspreload.appspot.com/" rel="nofollow">https://hstspreload.appspot.com/</a>