Fine, just have your webserver give a 401 to everyone other than the IP address you want to access. If you really want port knocking to get in then have your server listn on port 52485 or whatever and add the IP to the allowed list.
I would rather the server doing any processing of the packets be running as a low privilege user than sitting in the kernel.
Yeah, integrating identity providers could work, knowing recipient email addresses and that they use particular services. However that has some complexity/libraries and as with that - vulnerabilities all over again. I just don't want to think/expose attack surface and give possibilities for automated attacks to leak personal data.
Or lets say it like that - I trust iptables more than myself integrating identity provider or depending on some library.
Actually this is what onedrive/photo galleries etc. does when you share files/folders - generates some magic link that penetrates auth. However it's the same story - I trust complex system (that may have well known vulnerabilities and I was on a vacation) less than iptables.