> Your messages are cleartext, can be forged

Digital signatures are permissible under the current rules and in principle avoid this issue although the software tooling around it isn't there. Similar example: Debian packages are transmitted over HTTP, but this isn't a problem because they are authenticated with GPG.