Every website should use HTTPS. It's the right thing to do. It's not hard to do these days.
Unless you use simple tools like GitHub pages. I have a bunch of tiny JS heavy static projects on Pages that I can't easily add HTTPS to.
A current project of mine has some usability issues because it accepts external API requests but I won't allow non HTTPS. It would give me great pleasure to accept all possible APIs, but it's just not right to open users to that risk.
It's not really that hard. Set up auto-renew, make sure the box is up to date and properly firewalled. You won't really have to think much about it.
There are legacy setups like S3 with custom domains, probably github pages with custom domain. But in both cases there is no reason not to be using cloudfront or cloudflare.
I understand that's not technically "your problem", but since you mentioned it, just thought I'd let you know :)
It's unfortunate, because tumblr really is a great blog hosting software and service, if you don't use the social aspects of it.
But these aren't technical limitations! I don't know why Tumblr retricts you from using cloudflare, presumably because they want to control your content.
My two cents, don't use a free hosting service. S3+cloudfront is dirt cheap and will do the trick.
Are you aware of a workaround? Otherwise, I agree with the ease now that LE supports DNS verification. I just wish we could edit existing domains in Gitlab.
I'd rather deal with the very occasional “why not secure?” e-mail rather than pretend my site is actually secure. (I only serve static pages, not forms.)
And regardless of that it offers privacy for your users.
Beyond privacy it also vastly improve security too, since users are most likely to have malware and ads injected by an infected wifi router.
It also increases complexity of an attacker that has control of the local machine, since they'll now have to install a custom root certificate.
Nothing is perfectly safe, all we can do is raise the bar.