Comment on Is HTTPS required to be added on other instances?
Using webfinger requires HTTPS because it's defined that way in the webfinger spec.
Federation with non-secure instances is currently allowed otherwise but shouldn't be (https://todo.sr.ht/~vpzom/lotide/132)