I could be naive, but I don't see how this would be any more unreasonable than requiring HTTPS
Requiring HTTPS was very unreasonable. You have so many more moving parts that can go wrong, and a business relationship with a CA (even if it's Let's Encrypt). We only tolerate this because the alternative is worse.