They can start with using HTTPS for everything and hosting things like analytics (Piwik rocks!), javascript libraries etc. themselves.