@trwnh another option is accepting the sender-provided metadata to start, and then verifying on a schedule that recognizes that thundering herd problem -- say, a randomized delay between 1 and 300 seconds, with an exponential backoff. And I definitely think having a trusted shared caching server can help immensely.