I think that's absolutely reasonable to penalize. From a technical perspective, returning a different resource depending on the scheme of the URI is absolutely

I think that's absolutely reasonable to penalize. From a technical perspective, returning a different resource depending on the scheme of the URI is absolutely acceptable, but from a UX standpoint it's ridiculous to have a difference between http and https.