So I should compromise my users security for the incredibly obscure use-case of people who want to browse with their own hand-made tools?
There are several readily available TLS stacks for embedded systems (CyaSSL, PolarSSL, etc.) and plenty for other platforms (Open/Libre/BoringSSL, NSS, etc.), so 'people without a working TLS stack' is not a real-world use case you need to take into account.
The argument is that someone may not be able to audit TLS stack, not that someone may not be able to use TLS stack.
Requiring TLS forces people to include TLS stack, which enlarges trusted computing base a lot. Security depends on many things, but the size of trusted computing base is an important factor.
Comments
So I should compromise my users security for the incredibly obscure use-case of people who want to browse with their own hand-made tools?
There are several readily available TLS stacks for embedded systems (CyaSSL, PolarSSL, etc.) and plenty for other platforms (Open/Libre/BoringSSL, NSS, etc.), so 'people without a working TLS stack' is not a real-world use case you need to take into account.
The argument is that someone may not be able to audit TLS stack, not that someone may not be able to use TLS stack.
Requiring TLS forces people to include TLS stack, which enlarges trusted computing base a lot. Security depends on many things, but the size of trusted computing base is an important factor.