Certificates are free. The required competence is only marginally more than the required competence of setting up a website, and is rapidly dropping to zero more. (And <i>is</i>, if your website is hosted by a third-party service, which is a pretty reasonable approach for the organizations you name.)<p>I don&#x27;t understand what you mean by &quot;Outsourcing security without knowledge is praying for being abused.&quot; From your original argument, the website admins don&#x27;t care about security, right? So the worst that happens is their setup is insecure, but their setup was insecure to start with, and the were okay with that. You aren&#x27;t <i>more</i> at risk from outsourcing your HTTPS versus just not doing HTTPS.<p>I&#x27;d be very surprised to hear that people in Alaska are getting their internet via an HTTP cache. Frankly, I&#x27;d also be surprised to hear that people in Africa are, except possibly for certain mobile internet. I&#x27;m curious, where does this happen?<p>Even so, and especially for mobile internet, HTTPS isn&#x27;t a problem. The provider gives you the phone, so they can control the software, certs, etc. on it. They can run a caching proxy server that takes &quot;HTTPS&quot; requests in plaintext, and sends them out over HTTPS if they can&#x27;t be satisfied from the cache. (It&#x27;s pretty easy to configure an HTTP forward proxy this way.)