chasej@ and I talked about this a bit.  I'm a little worried about expanding the webexposed tests too much.  There are TONS of different IDL attributes that the webexposed tests don't check for (how about just adding/removing arguments?).  We're working on some IDL diffing tools to be exhaustive here.  IMHO we should probably keep webexposed simple to just help catch the common case of accidentally adding or removing an API.  They're already a real pain for people to update (something paulmeyer is working to fix).

That's cool (and close this off if you want); we do have scattered tests for "this interface should not exist in non-secure contexts".

We might want to standardize on that in WPT, e.g. always have interfaces.html and interfaces.https.html for anything that has [SecureContext]