This sort of thing is why I look askance at the "you don't need certificates" crowd. In the US, at least both Comcast and AT&T have a long and well-documented history of injecting advertisements into websites when the lack of a certificate lets them get away with it. Maybe you don't care about eavesdroppers, but you should care about a malicious network tampering with your content in-flight.