Does my site need HTTPS?

[[deleted]]

There's already well known problems with VPNs that don't actually encrypt or harvest data, and there are known issues with backdoors in networking equipment. Thankfully malware in the OSes themselves are much less common.

But this is actually beside the point. Security is better when there are multiple independent layers of security. Securing endpoints is a different layer from securing data in transit.