Comment by saulpw

You actually do have to use HTTPS nowadays, and that's a non-trivial amount of complexity compared to just serving up a static page over HTTP.