Reading this article and the comments here I'm stuck by how complicated (at least non trivial) the whole thing is.

At the same time we are trying to push every website (including blogs, little-league clubs, joke sites) to https-only.