He's right.  The reason btc.to needs to use HTTPS is to prevent Man In The Middle attacks.  Currently. someone could change the return value of http://btc.to/1 from the real address to their own address.

That being said we've always planned on adding it, we were just waiting to see if btc.to would get some real traction with users.  At this point we feel it has and will be adding HTTPS as well as HSTS soon so no matter how you access it you'll always be protected using HTTPS.  We'll also start publishing our entire DB shortly so that people can verify for themselves we aren't manipulating the shortened addresses.

He's right.  The reason btc.to needs to use HTTPS is to prevent Man In The Middle attacks.  Currently. someone could change the return value of http://btc.to/1 from the real address to their own address.

The crypto is not exceptionally slow, but the additional packets are. A full TLS handshake requires at least four additional packets. Also, some browsers will delay the connection until they've performed an OCSP check on the certificate, which can alone take up to a half second. All of this can add up to seconds of additional delay.