I feel like people just aren't used to it ("What is this green lock in my address bar? This is just XYZNewsNet, if they need security, they must be doing something wrong", so large sites aren't inclined to make the switch.