I really don't get why Google doesn't have the option to serve these requests from the website's domain (maybe even using a random subdomain each time).
Considering Google has their own CA or could use Let's Encrypt, it should be more than feasible.
Shh, don't give them ideas!
They're doing that with the new version of the analytics I think.