What you're wishing for is STARTTLS for HTTP. This is actually proposed by RFC 2817, which was written in what is now Ye Olden Days of Yon Internete.
I found some quick references that suggested that both Apache and lighthttpd support this, but further research is disappointing for lighttpd — sorry about that. Here's the documentation for setting it up with Apache, though; basically:
There's also no client support. IE7 supports some nifty TLS extensions (name-based SSL certificates may be possible in our lifetime), but apparently not STARTTLS/RFC 2817. And there's an open bug for Mozilla, with a lot of details still to be worked out. One of the issues is the RFC makes encryption really optional, and that's not generally desirable for most applications of encryption on the Internet. But since you're using a custom client, neither the lack of general browser support nor the security issue is a concern.