I don't see how is this any different from any other signal that Google uses to prioritize sites. Forcing small businesses to buy certificates doesn't seem any different than forcing them to have faster websites, for example.

There's an argument for more diversity in search engines, but I don't see how is that specific to this signal.

There are strong arguments for not enabling privacy by default - not least since it prevents any kind of decentralization or caching of content.

How does it prevent decentralization?

At a time when OpenSSL just suffered one of its worst bugs in history, forcing small sites to assume the risk of running code like this, which they inevitably will get wrong, materially worsens security for all, it doesn't improve it.

How many people could exploit Heartbleed before it was publicly announced compared to how could sniff traffic on open networks, as countless tutorials explain how to do?

Heartbleed was bad, and OpenSSL is a mess, but let's pretend that unencrypted logins are somehow less bad.