HN has been, for a couple months already, HTTPS-only, and it uses HSTS and disallows framing in the response headers, so that's pretty good. It wouldn't hurt though (probably) to get added to the HSTS preload lists of Chrome [1] and Firefox [2].

[1] https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr...

[2] https://github.com/mozilla/gecko-dev/blob/master/security/ma...

Trusting the SSL certs is another thing though.