Loading an iframe over http is at least not going to expose the users password to a passive attacker. I would really hate if we repeated the error whereby sites signed with non root ca keys got marked with a big scary error, because it wasn&#x27;t as secure as it could be.