Unfortunately the lack of a proper SSL certificate is rather off-putting, but it is an interesting idea. It reminds me a bit of this article about securing an API without OAuth: http://www.thebuzzmedia.com/designing-a-secure-rest-api-with...

Hopefully I'll have some time to dig into it later - I am curious how this was done.

The code is available on github, have fun...