The Crypto Interface specifies randomUUID() as "[SecureContext] DOMString randomUUID();"

I don't see any reason for this to be locked to secure contexts, as it doesn't do any actual cryptography, apart from using secure random bytes. (which can be obtained outside of a secure context via getRandomValues() anyways)

Inspired by the errors I get when I try to open my locally hosted website on my phone for testing.