> Or they might try to be a little too clever with HTTPS upgrades.

They're not going to get any cleverer than they are now. In October we'll finally be done with heuristics or central databses of https-first websites used by the various browsers or the half a dozen of headers that you must dance around to get the upgrade to work securely and reliably. They will just default to https first.

https://blog.google/security/https-by-defau/

Yes this is about Chrome, but all others will follow.