I'm designing a web-based notification framework (i.e. a user can subscribe to updates from a service or another user) where communication between users is encrypted.
User-to-user communication on the web requires a server to act as a relay - the twist is that I'm running on the assumption that the server itself is compromised (although the clients are still secure).
I believe I've designed a set-up that means the worst a server can do is analyse message sizes and IP addresses, or drop notifications. That is, even a malicious server can't read the actual content of the notification.
Bundled along with the notification system is a way to provide secrets for use with existing APIs. So you might present a basic profile on the web (as an API), and I "subscribe" to your profile (signed with my public key, etc.) and one of the first messages I get through my notification stream is a set of secrets that I hash/sign my requests to your API with in the hopes of getting extra content.
So my question is: are there existing techniques (or even standards!) for this kind of thing, preferably JSON-based? Before I try and get feedback on my wild plan, I'd like to know whether there's an existing setup I can either use or imitate.