At Merchii we have solved this in similar fashion, but we actually don't need to care if the host site is secure or not - we take care of that too (completely secure).