Thanks for the response, and the link.

The trouble with this method is that it creates a publicly-accessible, unauthenticated feed of my calendar and all the event data in it. I don't deal in a lot of particularly sensitive trade secrets, so I'm less concerned than others on this thread about the notes being unencrypted in your cloud. Encryption would be great, but I have a reasonable expectation that you're not just letting anybody who finds it scoop up your whole database. But that's what publishing a calendar feed does. I can't leave an open door to the internet (however obscure) to all the potentially confidential information that someone might send me as part of an event. I'll have to wait for "real" exchange support.