I had a quick look, and indeed this subdomain can be secured entirely. Unfortunately, the Steam ruleset is disabled completely these days, as it caused a lot of breakage, so maybe we'll want to split that ruleset into a breaking and non-breaking part. This, unfortunately, will be a bit of work.
Trac: Username: fuglede Sponsor: N/AtoN/A Severity: N/Ato Normal Reviewer: N/AtoN/A