The forms should not always load from https. They use protocol relative urls to load using the same protocol as the page on which they are placed. Can you provide an example page on which you're seeing with them always load using https?
You are correct that the script that the embed code dialog spits out is synchronous by default. This is simpler to use for most customers, and it guarantees that scripts load in order and will be able to execute API calls. However, there is nothing wrong with using a script loader to make the calls asynchronous. For many customers, waiting for the form to load before showing the rest of the page can be desirable, we've found that most forms live on pages that are form-centric and that don't make much sense rendered without a form in them.
Although the async script loader posted above works for simple cases, I’d recommend using a more widely deployed and tested script loader. Here’s how you’d use a script loader like labjs (http://labjs.com/documentation.php) to load the scripts async but in order.
If your embed code popup spits out this:
<script src="//mlm.ian.dev/js/forms2/js/forms2.js"></script>
<form id="mktoForm_1006"></form>
<script>MktoForms2.loadForm("//mlm.ian.dev", "236-OJN-811", 1006);</script>
Then if you download labjs and put it on your server, you could change the above to this, which would safely load the forms asynchronously.
<form id="mktoForm_1006"></form>
<script src='LAB.js'></script>
<script>
$LAB
.script("//mlm.ian.dev/js/forms2/js/forms2.js") //load the forms library
.wait(function (){
MktoForms2.loadForm("//mlm.ian.dev", "236-OJN-811", 1006); //call the loadForm function
})
</script>