One thing you're missing is that many people (including customers) consider SSL necessary any time you're accepting personal info, like when they create an account. SSL certs aren't that expensive.

The built-in offline CC module sends you part of the number and deposits the rest in the database. Insecure, in my opinion, but it should let you do what you want. If you really want them to phone, you'll have to modify one of the existing modules, like COD.