Secure contexts: this feature is not restricted to secure contexts. I don't
see any reasons to restrict it in secure contexts. If you have any
concerns, please let me know.
Is this feature enabled by default in sandboxed iframes?: Yes (though
obviously, it requires script and forms to work).