Short term signatures are the generally recommended approach, especially if you control the client and producer. You give the client a 1/5/60 minute signature,

Short term signatures are the generally recommended approach, especially if you control the client and producer. You give the client a 1/5/60 minute signature, and consumers you authorized can get it. Protecting from MITM is a separate (important) concern for that approach to be valid though, and it's not 100%. If you use an integrated cloud+cdn solution, the problem is largely solved for you, assuming you pick up the best practices and run with them