It may be that content authors want to prevent sandboxed content from being a Secure Context even if the target of a sandboxed frame is an https URI, or even if the content of the document is otherwise known to have been securely transported (a srcdoc attribute inline in the sandboxing document, say).

Maybe the sandbox attribute should have a new allow-secure-context flag that is required for the sub-document to create a secure context? (That would have the added benefit of making authors explicitly state that the content of a srcdoc (say) was securely delivered which makes things a bit more robust than what we have now where we just assume that to be the case if the embedding document is a secure context.)

CC: @mikewest @annevk @bzbarsky