I ran into this topic while building my own application — the kind that gets installed on a user's site and works in tandem with a remote server. The scheme looked trivial at first glance: on installation, the module sends its domain and email to the server, the server registers a new client, generates a key pair, and returns it. From there, the module talks to the server, signing its requests with its own secret.

Everything looked simple right up until I started asking myself some uncomfortable questions.