Interesting - looks like chart.googleapis.com works over HTTPS:
https://chart.googleapis.com/chart?chs=150x150&cht=qr...
but chart.apis.google.com (which Google formerly used) does not: https://chart.apis.google.com/chart?chs=150x150&cht=qr...
Turns out I was looking at some outdated docs. Thanks!