&gt; #2 and #3 are just because Google and browser vendors simply limit these things to HTTPS. It is not like it can only come with HTTPS.<p>True for &quot;signaling value&quot;, but for powerful browser features that the user grants or denies on a site-by-site basis, there&#x27;s a critical reason to only allow those for HTTPS.  If you allow those features for HTTP, you allow them for anyone who can MITM your connection and spoof those sites.  Any random ISP, open wifi, or other entity could trivially MITM a popular site via HTTP and obtain privileges it should not have.