>https exists. Why a second security layer? Of course there are a lot of use-cases where you need more than one layer. But for most cases https is enough.

Https isn't everywhere you think it is. (e.g. Linux and mobile):

https://transparencyreport.google.com/https/overview?hl=en