> HTTPS is not easy to set up unless you happen to be using a system that does it automatically via LetsEncrypt, which is fairly rare. And I don't know how you think you can use HTTPS without a certificate.

What I meant is that you can use a self-signed certificate, which is takes seconds go create. Some server software will even do it for you if I remember correctly. If this is too had for someone to implement, then they really have no business building web apps.

In a world where unencrypted connections are scary and an encrypted but self-signed connection is treated like HTTP connections currently are(not scary), it only makes sense for people to support HTTPS. There's nothing inherently hard about implementing an HTTPS service beyond one extra initial step.

Beyond that, there's LetsEncrypt, and services like AWS will take care of creating signed certificates for you; I imagine they aren't the only infrastructure host that does this.

Let's encrypt isn't difficult to set up at all. Like, at all at all. Not even a smidge. A fifth grader can do it after reading a simple tutorial.