True, I just searched when the standard was created, my point still remains that by 2002 most sites were probably without HTTPS though. Heck, I remember in ~2012 when I started programming about half of the login sites I used were without HTTPS!