The answer is probably to have a way to sign and/or encrypt headers separately so that clients can request authentication and/or encryption on a per-resource ba

The answer is probably to have a way to sign and/or encrypt headers separately so that clients can request authentication and/or encryption on a per-resource basis. Perhaps a public and a private header section. Checksumming and cryptographic signing of responses as an alternative to full-blown encryption might be useful as well (since response signatures could still be cached).