HTTPS isn't a guaranteed key