I have a GAE application that is mapped to a subdomain on a custom domain. As the result, I have to use HTTP for everything that's being served under that subdomain. This is marginally unsecure, but is acceptable for most of the application except paymets/subscription part.

Right now, I'm leaning towards using Stripe for processing and building a custom form to handle the signup process. It seems that the only way to get HTTPS is to redirect the user explicitly to https://.appspot.com/ and then send them back to the custom subdomain. I also considered a pop-up.

Are there any other ways to implement secure payments page on GAE?