&gt; At least it wouldn&#x27;t be intercepted on that hop<p>It wouldn&#x27;t be <i>passively</i> intercepted.  It could trivially be actively intercepted.  Gmail would not display a warning in this case, thus making the user think their password&#x2F;reset URL was safe when it really wasn&#x27;t.  And trying to inform users about the difference between passive and active interception, and expecting them to make a risk evaluation based on it, is just not realistic for the vast majority of users.