Not much point in serving .sig's and your PGP key if its over HTTP. Unless you're already in someone's WOT, there's nothing to verify against. At least if you use HTTPS we can somewhat trust that we're being displayed the key you think we should be displayed.