Discourage use of insecure HTTP for client_id and redirect_uri?

Per https://indieauth.spec.indieweb.org/#client-identifier:

>Client identifier URLs MUST have either an https or http scheme

But the spec does not discourage the latter, nor whether the server may reject the latter, and same for `redirect_uri`. Should there be some explicit discouragement?

Start by reading the client identifier section at https://indieauth.spec.indieweb.org/#client-identifier and review the issue comments for any existing decision. Done means reaching a clear decision on HTTP client_id and redirect_uri handling and updating the relevant specification text accordingly.

Written by the indexing model from the issue text.