Only slightly related but even Amazon isn't on HTTPS, which I find to be a much bigger issue since they deal with credit cards

Both https://amazon.com and https://amazon.de work for me.

Was hoping someone would say this. This should be the only thing they focus on this year until it's done. I see that they POST to a secure endpoint when logging in but that doesn't make a difference once the session cookies are transmitted in the clear.

yep, this is on our roadmap