The Cards docs specify that all content (iframe, assets and stream) are required to be served over HTTPS:
https://dev.twitter.com/docs/cards (under “A Few Simple Rules”)
However, currently approved twitter cards, e.g. this one from Soundtracking, do not follow this. For ex:
When you play the stream, the SSL lock breaks (orange warning) in every browser I’ve tested in.
Are we expected to wrap audio streams in SSL? It does not appear other developers do so currently.