[gizzlon]

I'll take that as a "yes" ;)

AFAIK, neither signatures or "something you have, know" alone fixes replay attacks. Since this is a well known problem in cryptography, many solutions exists. All of which are probably overkill for this use.

[shaydoc]

At least with the use of a digital signature and nonce you can guarantee that the request hasn't been tampered with!