> The only thing I haven't figured out yet is how to stop people from publishing open source clients

Forget about that - someone will create a web interface for the protocol and you're back to square one.