It's still not a requirement

It de-facto is. All major browsers will yell at the user saying in more or fewer words that the site is dangerous to view if it’s not connecting over https.