pmaiorana

whatever.scalzi.com is on WordPress.com VIP—same platform, but a different segment of users. Our VIP sites often use 3rd parties (mostly ad servers) that don't yet support https, so we haven't defaulted any of those sites to https—it's an option available if they want it though!

Nope — login pages have been https for many years.

Definitely—but far less work than starting from scratch. The goal was not to make it 100% plug-and-play for everyone, because that would be...impossible. :)