Does anyone know how non-primary domains are handled? I.e. JS/fonts/etc from outside the primary domain (analytics services and the like).

There is a 'mixed content' warning when these aren't SSL, but I haven't read anything about a similar warning if they are on SHA1.