I think this is at the core of Google&#x27;s thinking on this: unless presented with a negative, users&#x27; assumptions are that they&#x27;re secure.<p>Which is fair, given that I bet you&#x27;d get about a 5% or less recognition rate if you polled a random sampling of people on whether they could define &quot;HTTPS&quot; &#x2F; &quot;SSL&quot; &#x2F; &quot;TLS&quot; &#x2F; &quot;That lock thingie&quot; to any degree of accuracy.<p>A server shouldn&#x27;t have the opportunity to serve an insecure connection to the user without the user being made explicitly aware of that fact.