Apropos of the Shop outage yesterday: It is trivially easy (albeit usually expensive) to strip SSL connections, and do it in a way most end-users won’t be able to detect.