"The support document, provisioning page and authentication page must all be available over HTTPS, and the server's SSL certificate must be certified by a trusted CA whose certificate is in the standard Mozilla certificate bundle."

I suspect you're still stuck in the "users will just use somebody else as their identify provider" trap. We've seen where that leads - it gave us Hotmail, GMail, Facebook, G+, "MS passport", and the like. Persona, on the other hand, correctly allows anybody to host their own identity - iff you can pay for it.

"millions of users"

Stop with the narrow thinking - that's not the only use-case for encryption, as the internet is not a many-to-one medium like TV. The personal website I put up for my friends should be encrypted, just like everything else we send over the net.