The site is incomplete. I wouldn't worry about the lack of HTTPS yet...
So someone could phish it and pretend it's complete to get people's data...
It takes very little effort to provide a cert these days. Even a landing page should have a cert. Especially from a company with a reputation for security and privacy like protonmail's.