If you really want to help your (clueless) users, never ever serve a login, registration or credit card form without CSP. It really helps - at least until the malware catches on (I already see "Kaspersky Labs" is injecting its domain into the CSP itself).
This does mean that currently CSP can stop various malware-ish extensions, but also that it stops legitimate ones (e.g. say an extension wants to apply a certain font that the user finds more readable to the entire page). It's a tough tradeoff.
But yes, the best plan is to have HTTPS everywhere, something that looks a lot closer than it once did! Thanks NSA!
I don't follow your reasoning. Why wouldn't an MITM attacker modifying an HTTP response body to insert rogue Javascript also be able to modify the response headers to strip or alter the Content Security Policy?
I still am willing to bet that SSL is not impossible to MITM. Someone will manage to find a flaw in such a complex system.
Man, World Of Warcraft flashbacks can be intense sometimes...