Yesterday we had another major vulnerability that would have been much less severe if the default was secure: https://lists.debian.org/debian-security-announce/2026/msg00526.html
I strongly believe that the best way forward is to have our users secure by default. And letting those users who want to take on a higher risk in order to have an easier time implementing caching configure their systems to behave as they want. +1 on letting the default be https from me.
