> HTTPS end to end isn't really worth it for some things.

Don't agree. Serving HTTPS is cheap now, and it's easier just to put _everything_ on SSL and avoid the mental effort of deciding what goes where.

Ah, but part of their argument is that it is always worth it so that when it is worth it, that content doesn't stand out. So, by their own argument, they should enable https even for the static content pages.

Not that it's particularly expensive either. A single domain cert can be found for a few bucks, a wildcard for under 100.