Smári here, from the Mailpile team. There's no HSTS because Mailpile is generally supposed to be run on localhost. We don't bundle SSL certs because it simply wouldn't make sense. That said, we will be improving things w.r.t. use of SSL and Internet-facing installations before 1.0, including authentication mechanisms and such. We will also be doing some Content Security Policy work before 1.0.