This sounds vaguely similar to Managed Service Identities in azure as well. Apps can ask a well-known IP that maps to a local service on the VM host for an oau

This sounds vaguely similar to Managed Service Identities in azure as well. Apps can ask a well-known IP that maps to a local service on the VM host for an oauth token to any azure service, and then it gets back a token with an identity tied to the VM/webapp/function app without needing to do any of the oauth flow itself. I don't think it quite gets to the point of signing content or encrypting connections, though I might have just never seen it.