Incidentally, the second most frequent contributor to hg-git after schacon is Augie Fackler, one of the Google engineers who helped with Google Code's git implementation (and also a frequent hg hacker).
Security, speed, all that's don't outweight http protocol support?
The ID for Hg changesets are some 48-bit numbers, like fb43b575b296. I do not think that this size is safe enough.
Are you pushing to a local repository? When pushing to a local repo, dulwich calls a local git binary. I don't see any calls to git-index-pack in either hg-git or dulwich in a cursory grep, which matches my memory.