In the beginning insecure only meant "I want to perform discovery over HTTP if HTTPS didn't work". But right now it means "I want to perform discovery over HTTP if HTTPS didn't work and I even want to send my credentials over HTTP". These meaning should be split.

The functions with insecure flag are discovery.DiscoverPublicKeys, discovery.DiscoverEndpoints and discovery.DiscoverWalk. I only checked discovery/discovery.go and discovery/http.go.

I didn't check if there are some other parts of this project that do similar things.