Comment by KomoD

> * Why would anyone pick the flexible/potentially-insecure option?

I pick it whenever I don't want to setup HTTPS on my origin but still want HTTPS. Just for projects where I really don't care.