Top sign-up link is https, but you're correct that it's possible to load it as http and the sign-up in the body of the page links to the http version.

They need to redirect any http to https for the sign-up page; they already do this for the login page.