Both the blog and the homepage are served over TLS for me. And they’re forcing plaintext to TLS ... so not sure what’s wrong on your end.
Fixed it, thanks!
Can you elaborate?
It looks like you fixed exactly what I was seeing. It seemed odd for a site dealing with security to not be served over SSL. I'm not sure what the issue was, but it appears to be resolved.