There is also a model where the applications sign the payload using the secret, AWS is a big user of that across all its API's.

This is not something we support currently. We will need to do some research on ways to support it.

The main hurdle is that we can't rewrite secrets in any of the user buffers as this will defy our threat model and signing is usually done in user space.