• It allows retro computers to connect.
• It allows very low power embedded devices to connect without extra overhead.
• It's not a real security concern if you're on a private network.
• It allows very low power embedded devices to connect without extra overhead.
• It's not a real security concern if you're on a private network.
I'm not convinced that private networks should be assumed secure by default.
If you are still concerned, you can make API keys that have been registered by TLS to require TLS, while those that haven't, do not require TLS.
(However, the note about private networks only applies if you run the service yourself. Sometimes this will be the case, though. Even then, the administrators can configure it to use TLS if this is desired.)