I'm developing a json API that should be able to handle a huge amount of clients. To make this work I need to reduce the overhead as far as possible.
One of the ideas I have is to use https only in the initial registration process of each client to exchange a symmetric key that is generated for each client. This would enable me to use http with symmetric encryption and a minimum overhead. Do you see any downside and security issues in this?