At present, the web pretty much defaults to non-secure content and HTTPS is the exception that warrants a visual call-out. But that's a temporary state and it's all about to change.