I agree with you that SE should be using something protocol-agnostic. As per the [answer][1] given by Anna Lear: (copied only relevant part)

> Because HTTPS support is still a work in progress. We're upgrading
> parts of the code as we go along. For example, [user avatars are served
> over HTTPS now][2]. 
> 
> We should use protocol-relative URLs more, I agree,

Also from the comment:

> All the assets we use will eventually use the appropriate protocol.
> That's (part of) the plan. :)

So, basically it's a work-in-progess and that's a good news.


  [1]: http://meta.stackexchange.com/questions/264367/the-stack-exchange-network-is-still-using-http-for-google-fonts/264448#264448
  [2]: https://twitter.com/Nick_Craver/status/636942821543542784