Describe the problem you are trying to solve

In light of recent developments in the Java ecosystem I think Rust should follow that and also mark "http" sources as deprecated or warn about them in some way.

Describe the solution you'd like

Correct me if I'm wrong here, but pulling sources from http:// instead of directly from crates.io, likely via git does require putting it in its own Toml section either way, right?
One could then require a switch similar to allow-unencrypted-http = true.
In a first step just outputting a warning/deprecation notice if this is not set but the source is http:// should be fine, and after some time one could then switch to this aborting the build.

Notes

This would in the second stage break builds, with the fix being a configuration option.