At present we get warnings on pages loaded over https which have coverart. We'll need to pester the IA for SSL support for the CAA, but at least amazon provides SSL images (albeit from an annoying undocumented place), and some of our other providers probably also have SSL alternatives.