Isn't this solved by HTTP-Signatures, which is a draft RFC? I guess not, as there's no way to forward that signature to a third party without some imposter-ing, depending on the HTTP headers that were signed.