Currently, even when the "Show Full URLs" option is enabled in Orion on mobile, the protocol is hidden. Which is to say: if I navigate to
http://example.com,the address bar will display
example.com. If I navigate to
https://example.com, the address bar will still display
example.com. This is important information that's being hidden! There are good reasons to avoid typing in passwords, for example, on non-HTTPS sites.
As things stand, the only way to check is to tap on the address bar; the protocol will properly appear at that point, even if it doesn't appear in the resting view. But this is an awkward workaround, and really shouldn't be necessary.
So I suggest modifying the address bar preview so that—at minimum for anyone who has "Show Full URLs" enabled in settings, if not for everyone else, since people with that setting enabled have pretty unambiguously opted into verbose URL readouts—it displays the protocol there directly. Make it so that the address bar preview after navigating to
http://example.com, and the address bar preview after navigating to
https://example.com, rather than both collapsing down into preview text of
example.com and leaving the security status of the site unclear.