https://geoip.xfce.org is now available in https so it can be a good idea to use it.
Same for https://nominatim.openstreetmap.org/ and https://met.co. It seems that only http://api.geonames.org does not support https (yet).
Note that https://met.no/filestore/met.no-logo.gif does not exist anymore (maybe use https://www.met.no/_/asset/no.met.metno:1497355518/images/met-logo.svg instead ?)
Note²: Since libsoup 2.42: "The system TLS/SSL certificate database is used by default to validate https certificates, and sites with invalid certificates will refuse to load with a SOUP_STATUS_SSL_FAILED error" ( https://developer.gnome.org/libsoup/stable/libsoup-session-porting.html ). We can bump minimal libsoup version and check return code in weather_http_queue_request ?
Sean Davis referenced this bugreport in commit 266992cfab8061289419376b49dc15c04cfb177b
Use https where possible, fix link to met.no icon, use a GtkOverlay for simpler position of icon (bug #13645)