Wouldn't it make more sense just to fix the URL bar to make data URIs look different? You could even go to the extreme of making it just show "data:…" and requiring you to put focus on it to find out the full URI.
security.insecure_connection_icon.enabled
security.insecure_connection_icon.pbmode.enabled
Though it's still disabled by default (currently the insecure connection icon is only shown if a password field is present on a http page / the form action url is http).