True, I'm not surprised at all. HTTPS Everywhere-like functionality should be integrated into browsers and not a downloadable extra, tricking people into feeling fully secured.
Force SSL only: http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
Have site preloaded in Chrome: https://hstspreload.appspot.com