@wumpus It looks like some of the oneboxing includes images pulled over http. This post has an example.
It pulls this image:
http://cdn.arstechnica.net/wp-content/uploads/2016/08/vlcsnap-2016-08-08-23h31m17s326-640x363.png
The https version of the image works, too, so it is possible to hit the Ars Technica CDN with a secure connection.