Just guessing here, but I think you could do it when sending them to the checkout_success page.
I wouldn't think it would be a problem because they have already completed a transaction and it isn't that likely they would continue shopping.
The bandwidth hit with encrypted pages isn't as important anymore with fast servers and easy access to fast connections.