TLS is widely touted as securing the web. This year I've heard some
compelling arguments that this is false advertising.

Here's a good summary of the issues that are readily understandable:
http://cryto.net/~joepie91/blog/2015/05/01/on-mozillas-forced-ssl/

I'll omit the deeper issues since they are controversial and require
some background; email me if you want to hear about them.

The upshot for Scheme.org is that TLS is a standard which we must
support. But that doesn't mean we must _require_ it. I think we should
continue to offer plain unencrypted HTTP access. That should be
relatively uncontroversial for most of our sites, which host technical
content that is readily available to the world from public git repos.

However, some of our sites will have a login feature. Currently the only
one is Gitea but there will probably be more. Perhaps these should
continue to require TLS so that passwords are not sent in the clear?