I could be naive, but I don't see how this would be any more unreasonable than requiring HTTPS