I wonder if it's time to implement STARTTLS as an HTTP extension.
It could be put into Apache and Mozilla pretty straightforwardly.
Maybe other browser implementers would follow.