This is a malware injection problem and it should be possible for google to create signatures of JavaScript from different websites and have chrome verify it and block it.

Penalizing all http users is heavy handed and google should not go down that path.