There is a way to have more security than both answers (as of today) https://tezos.stackexchange.com/a/607/29 (Answer A) and https://tezos.stackexchange.com/a/598/29 (Answer B) suggest.
If the signer
- only accepts magic bytes 0x01,0x02,
- and the signer is firewalled to only accept request from the baker's IP
- and the tunnel is encrypted (preferably),
it is ok to leave the unencrypted signer auth key in the baker. You get the convenience of answer B, but with the added security of using a signer auth key (answer A). It doesn't protect you against every possibility (it is not possible at this time to pass the password to the baker/endorser, AFAIK even using one of these methods), but by having an unencrypted signer auth key you are still avoiding some potential risks . For example, if a rogue machine obtains your IP (say you release the IP by accident, or your host misroutes your IP) the attacker still won't be able to even simply double bake/endorse.
Some might say it is more work for little gain, but I am a bit paranoid and don't like to take the easier route.
--require-authentication is not a substitute for other precautions.