These guys receive requests from mobile devices. Afaik sending unencrypted HTTP requests is not allowed on some platforms (e.g. iOS).

You can disable transport security for a certain domain using the plist key NSAppTransportSecurity. But you rarely should do this :)

https://developer.apple.com/library/ios/documentation/Genera...

First, they can offer both http and https endpoints. Second, you can send HTTP request if you set NSAllowsArbitraryLoads=true.

I think you should think long and hard before you roll your own crypto.

You don't need to roll your own crypto in order to encrypt in-house.