Yes you need real HTTPS^[1], that's a good way to put it!

Oh and I forgot, you also can't use tor for sending 😬

1. TLS certificates from a trusted certificate authority like Let's Encrypt ↩