So, I could have missed something, but here's my reasoning as to why we should allow http as well.

First, we allow RPs to use Persona for login even over http. Their sites don't need to be secured with HTTPS. Of course, there's risk for the sites, that an attacker could adjust DNS to make the user log into the wrong site, or an attack could capture the assertion as the site POSTs it to their own server for verification, and login as the user. Still, we let the sites accept those risks, instead of demanding everyone who wants to use Persona needs to setup HTTPS.

Likewise, the realm is simply a group of sites that a user is logging in to. An attacker could hijack DNS to an http site, and declare a different realm than normal. Or they could serve up their own browserid-realm file, which could include a different list of sites. The user isn't automatically logged into any of those sites at that time. The user then needs to visit one of those sites, and that site (whether normally or by the attacker) would need to declare being part of the hijacked realm.

In the end, the worst that could happen is a user is logged into a realm or site that isn't really part of the realm.