... you know you can change that URL to start "https" if you like?

Of course you are right, but some commonly accepted procedure nowadays is to do that automatically with a redirect, as a service for the user. Sure, you may have a reason for not to do so, but instead of dismissing a valid argument you could maybe explain why not ...

Edit: On second thought, I recognize this whole subthread started with the wrong tone ("ironic", "reckless"), kind of dismissive or patronizing and not calling for a constructive discussion, so please disregard this comment of mine, sorry.

I do think that a certain level of scrutiny is invited by using a term like "for the truly paranoid".

With HSTS, you don't have to.