From what I got, it forces opportunistic encryption only. If there is no special signed cert available, it just generates one randomly and uses that. Unsafe against people who can modify your connection, but it protects against passive eavesdropping.

All major browser vendors decided not to implement opportunistic encryption in HTTP/2.

So they force either a valid cert or nothing? Not even unencrypted http/2? Because that would be quite awesome.

Edit: are there statements where they say they don't intend to implement it ever, or is it just not supported yet and e.g. Microsoft might still implement it later to please some enterprise stakeholder?

According to this[1], that's a permanent decision. Given that both Google and Mozilla have discussed plans that would eventually mark http:// as unsafe in the UI, I don't think that decision is going to change.

[1]: https://daniel.haxx.se/blog/2015/03/06/tls-in-http2/

Well there is a difference between unsigned encrypted and unencrypted, I'm not saying marking http:// as unsafe implies that they'll always regard unsigned encrypted as completely unprotected, especially with closed source browsers (or browsers where development is a closed process).

Thanks for all the information though! :)

From the point of view of an active MITM attack there is no difference between unsigned encrypted and unencrypted.