I guess I could put APP_SECURE=true or APP_SECURE=false in my .env file, and reference that in every single asset call ... that might be the best I can do. Doesn't feel elegant and Laravel-esque, though.

Try putting HTTPS=on or HTTPS=off in your .env file. No other editing should be required.

Maybe it will be helpful. Laravel automatically detect HTTPS and make asset schema by request protocol (just checks $_SERVER['HTTPS']). However, I faced the problem, that didn't work in my hosting. It was caused by using combination of apache and ngnix that changes HTTP headers. As a result, $_SERVER['HTTPS'] was renamed to $_SERVER['HTTP_HTTPS'], so Laravel couldn't detect HTTPS. In this case, you can write $_SERVER['HTTPS'] via PHP before detection (e.g. in public/index.php) or set schema via app('url')->forceSchema(...).