[wolfeidau]

After some consideration I would probably err on the side of caution and either use something like IPSEC AH (Authenticated Header), or build a session key exchange protocol using something akin to it's two phase approach, or even just perform HTTPS based request to exchange session keys.

This session key could then be incorporated into each of the HMAC signatures and would be refreshed on a regular basis similar to how IPSEC does it.

I have used AH in the passed for log data which required the receiver to verify the source for auditing purposes, but this was quite some time ago, these days most systems just either use SSL or IPSEC with ESP.

Reinventing the wheel is probably not the best idea in this case.

Will add a note on this to my blog post for completeness.

For more information on IPsec see http://en.wikipedia.org/wiki/IPsec