Github's hg-git plugin ( http://hg-git.github.com/ ) is built with this, and so manages to avoid a dependency on the git binaries.
Are you pushing to a local repository? When pushing to a local repo, dulwich calls a local git binary. I don't see any calls to git-index-pack in either hg-git or dulwich in a cursory grep, which matches my memory.
Security, speed, all that's don't outweight http protocol support?
The ID for Hg changesets are some 48-bit numbers, like fb43b575b296. I do not think that this size is safe enough.