I think it's worth noting that, at least for youtube.com, currently the app uses plaintext HTTP for everything, according to 3dbrew. Although it can load HTTPS content, because I went to my own site that forces it for every page.Actually it would be pretty simple.
Simply force SSL in the app, and hardcode it to only accept YouTube's SSL certificate. Any page other than YouTube would be unable to load.