Melbourne⇒Sydney, HoE @ Big Picture Medical, ex-Google/Airtasker (though not speaking officially for ANY of them, duh, what is wrong with you?). He/him.
Oh! Had been meaning to post about this, thanks for the reminder. Main part of reply below.
TL;DR: telling us why they can't use SSL, or even confirming such documentation exists, would "compromise the appropriate level of security" and "create potential vectors…for attack"
🙄