Ah, I see in header.php now. The code there seems ok – why doesn’t it use HTTPS for the Google fonts? Perhaps only I’m experiencing this issue.
One other thing is that the Google fonts are loaded over HTTP instead of HTTPS http://cl.ly/image/0Y3F1U2H2d1h
Even though the plugin mentioned in this thread makes sure the HTTPS is green, I still get the shield icon that says insecure content was blocked http://cl.ly/image/0o251d413u3G