Authentication in this context doesn't need to be end-to-end. Instead of a custom protocol, we could probably just use SSL client certificates authenticating the sending domain to achieve the same effect.