1) Why not implement passive encryption? Like StartTLS in SMTP? No need for HTTPS; could be part of HTTP/2 over port 80.

2) Pinning?

3) No, let's not do that. I want to be able to access my sites from my 2-year old devices that don't support SNI, like Android 2.3.