Probably will be a very unpopular opinion, but while I appreciate that HTTPS encrypts traffic, I do think a mandatory HTTPS usage comes with a cost, not so much mentioned in this thread. Here's what I think:

I think the mandatory usage of HTTPS centralizes the already centralized web even further. HTTPS itself is secure theoretically, but at the same time it relies on:

1. Trust in browser vendors: Basically the way HTTPS works currently is that all browsers have "trusted certificate sources" hardcoded. And there aren't that many browsers out there with meaningful market share--Chrome, Firefox, Edge, Safari, and that's about it (One may even say it's pretty much Chrome all the way, with rest of them trailing far back)

2. Trust in the certificate authorities: The way HTTPS works relies on "trusted certificate sources", like verisign. This was already way too centralized, but it will become even more so. I'm guessing eventually companies like Google or Apple will start acting as generic certificate authorities (as a verisign competitor) unless regulators cut in.

If you think about the implication of all this, the more we move towards an "HTTPS first world", the more power these entities will have and the more damage it will cause when one of them gets compromised.

Note that the web has never been forced to use HTTPS throughout its entire history, so we have no idea how this will play out and I'm just speculating based on my knowledge. HTTPS itself is secure, but as a lot of you know, most dangerous hacks come not from exploiting tech flaws, but by exploiting the weakest link in the value chain--the human factor. And when things become this centralized, the "human factor risk" becomes larger and larger. We have never before had a world where HTTPS was forced, so it's not easy to just visualize this or predict what will happen, but I can imagine there can be many ways the "The entire web can go down one day" because of the extreme centralization, and when I say "the entire web" I mean it literally. One day, some hacker will take advantage of the extremely centralized landscape of the web and probably be able to compromise the ENTIRE web, and you won't be able to browse the web all day, until Apple, Mozilla, or Google releases a security update. This will be way worse than what we've experienced with S3 going down, because it will obsolete security measures of ALL web browsers in one fell swoop.

Another thing I don't like about this "forced HTTPS" is that mandatory HTTPS makes it difficult to publish stuff to the web. You must either deploy your own Letsencrypt to run your website, or if it's too much of a hassle (which would be the case for most people, even developers), just run your website on a service provider that already has HTTPS.

This means people will rather publish their blogs on sites like medium.com rather than running their own wordpress server, or even a ghost blog.

And when this happens, where do you think people will flock to? Most people will flock to platforms that are most stable and have high reputation, such as Google, Facebook, etc., which will centralize the web even further.

I may sound like a tin foil hat conspiracy theory guy but I just wanted to share my thought since everyone seems to think "You must be fucking crazy moron to think that there can be some drawbacks with a forced HTTPS future". Google does have every interest to move the web this direction because they already own the "centralized web", and the more centralized it becomes the more they benefit.

Just to reiterate, I do think HTTPS is great, and user privacy should be respected. I am just providing an alternative opinion.