Nostr clients should likely support a https/wss only mode - largely for media requests, but app wide. Some countries spying and other MIM attacks can be avoided.