As discussed in this question on Meta.Security.SE, the SE OpenID provider seems to be using some sort of AJAX call to replace part of the page. The outer page uses plain HTTP, whereas the OpenID part (when the SE provider is chosen) seems to be using HTTPS (only visible if you use Firebug or similar).
The initial login page, referred to as the "login landing page", must be served over TLS. Failure to utilize TLS for the login landing page allows an attacker to modify the login form action, causing the user's credentials to be posted to an arbitrary location.
Whether SE uses HTTPS globally is a different matter, but the login page should visibly use HTTPS.