Pushing too hard for HTTPS can lead to HTTPS as security theater. Cloudflare offers this as a service; they call it "Flexible SSL". They get a multi-domain SSL certificate for a huge number of unrelated domains, and let people connect to that. The data is decrypted at Cloudflare, and retransmitted in the clear to the destination site. The user thinks they have security, and they have a little, but less than they think. The multi-domain cert makes some attacks possible. If an attacker can mess with DNS near the client end (perhaps at a public WiFi access point), and can break into any of the sites listed on the cert, they can do an MITM attack. A cert with both an important site and a weakly secured site creates an easy attack target.

Multi-domain certs are used because IPv4 space is full and Windows XP doesn't support Server Name Indication, which allows a unique cert for different domains at the same IP address. So if you want SSL on a shared IP address, and need to support good old IE6 over IPv4, multi-domain certs are necessary. XP still has 19% market share on line, as of October 2014. Everything else has supported SNI since 2007 or so.

I have a paper on this:

http://john-nagle.github.io/certscan/whoamitalkingto04.pdf

This identifies all the major front-end services using shared SSL certificates. Cloudflare has 36,280 second level domains tied to "*.cloudflare.com". Incapsula, the DDOS protection service, has 1471. Once you're past the top 20 such services, no site has more than about 100. Once IE6 has died off, the CAs can stop issuing certs containing unrelated domains. But not yet.