It should still be fairly easy to check for an API Key in the header if not found in the request parameters. This way there would be no disruption for old apps,

It should still be fairly easy to check for an API Key in the header if not found in the request parameters. This way there would be no disruption for old apps, and it would benefit new apps. I also think that both this and HTTPS are mandatory, but since it's on your roadmap that's good enough.