Good enough for what?

My site is just a blog with a bunch of prototypes and games.

My goal is an ad-free Internet.

If the client is worried about surveillance then it would be up to them to use an appropriate vpn - but if a three letter agency cares about who reads my blog, I‘ll probably have a lot more problems then a visitor.