In somewhat related news, the .trust gTLD is HTTPS-only: https://whodoyou.trust/globalassets/documents/trust-technica... (As well as having a bucket of JS restrictions (no eval() can be used, apparently ever)

Adam Langley said something about enforcing secure TLD restrictions in Chrome a while ago, not sure if that ever got done.