As John stated already, there is no change that DNN could make that would satisfy the criteria you have outlined.  The SSL handshake occurs long before even the first line of DNN code executes.  No matter what DNN does, we will not be able to overcome this issue without going around the native IIS SSL implementation which is not a real possibility.

As for putting common DNN code in a single DLL and making everything static/shared would not solve the performance problem either.  That could would still be loaded in separate appdomains for each website that was using the code.  Shared/static methods and properties are only shared within the single appdomain and are not shared accross domains.  Even if you could architect DNN to load a single instance in one appdomain and have multiple websites all access the same appdomain for those functions, you would necessarily take a huge performance hit because you would then be marshalling data for practically every method call across processes which is a huge performance hit.

Also, everyone should take the words "best practice" with a grain of salt.  In many cases, best practices makes certain assumptions about how a website will be used.  If those assumptions are not clearly spelled out then it is hard to say whether the best practice is really applicable to any specific usage.

Relating to DNN Security, SSLRedirect is an excellent add-on for SSL securing DNN web pages.  SSLRedirect provides the flexibility of using Regular Expressions to define which web pages should be SSL secured.  SSLRedirect also provides an output filtering feature which assist in eliminating the mixed content message received when flowing from HTTPS to HTTP web pages.  SSLRedirect works equally as well for native ASP.NET apps as for DNN apps.  SSLRedirects works equally as well with single domain SSL Certificates as with wildcard SSL Certificates.

Product brief can be reviewed by clicking on https://www.sanibellogic.com/SL/Products.aspx?Cat=DotNetNuke&PLong=00200

Product documentation can be downloaded by clicking on http://www.SanibelLogic.com/DownloadMe.aspx?uuid=7616144c-d302-403b-9291-bf4d21655c4b

SSLRedirect is also available on www.snowcovered.com ...just conduct a search for "SSLRedirect".

SSLRedirect has just been enhanced in support of DNN 4.5.0.

Philip