Agreed. However the http connection is redirected to https at the 
tracker. So after the first redirect HSTS should kick in so
that all connections to issues are done over TLS. So that helps.

Also http://www.roundup-tracker.org/ is not under TLS, so
that link from the homepage could be reset to http on the fly.
I would be more concerned about the tracker link reference
to http if www.roundup-tracker.org were under https.

I have changed all the references to http://issues in the website
subdirectory and just checked it in. So whoever does the next
deployment should get the updated link.

-- rouilj