Not sure if that would work for what you have in mind, but maybe people in the same 'realm' could all be on the same zerotier network (or maybe tinc, or somethi

Not sure if that would work for what you have in mind, but maybe people in the same 'realm' could all be on the same zerotier network (or maybe tinc, or something similar), and you'd have a firewall only letting the pub/sub traffic through that interface. Might be good enough for prototyping, anyway...