End-to-end confidentiality for Snowflake client registrations

Client requests sent to the /client broker endpoint use TLS to the front domain, and TLS from the front to the broker, but the fronting service itself (e.g. App Engine) can inspect them in plaintext. The fronting service unavoidably gets to learn the IP addresses of clients, but we could encrypt the additional metadata that appears in the registration messages.

I was thinking of giving the broker a private key and wrapping client registrations in a NaCl box.

This is roughly how it worked in flash proxy. The facilitator had a private RSA key, and client registration methods were encrypted before being posted to the facilitator. https://gitweb.torproject.org/flashproxy.git/tree/facilitator/facilitator.cgi?id=1.4#n60 The actual key material was isolated into a facilitator-reg-daemon process that was separated from the web server and facilitator CGI: https://gitweb.torproject.org/flashproxy.git/tree/facilitator/facilitator-reg-daemon?id=1.4