How exactly you are precluding yourself from doing anything by using http_require?

http_require is equivalent from the security standpoint to doing 'wget ...;..;make install' and myriad other less then secure things we do almost everyday (including on production server. how did you install sphynx last time around? did you check any signatures). http_require can be used in similar ways with same security effect. saying that http_require is somehow inherently less secure then those everyday tools is somewhat hypocritical :)

You would never curl -O && make install in a best-practices deployment, so comparing http_require to "not checking signatures" is apples/oranges.