George Stephanis is totally right in that in security the only thing that actually matters is your weakest link, and there is no point in trying to secure any sub system when you know in advance that other part remain less secure. Going with HTTPS as a requirement for the feature is the best way to go and than it will be possible to use the probably more simple oauth2.

Not that there is any sane reason to have that monster in core, but if you are going to do it, better follow industry standards instead of inventing your own.