> That occurred to me too. But HTTP/1.1 requires a Host: header.
Yes, but that’s easily forgeable as long as the servers in between allow it.
> It also brings a problem of key distribution.
Not really, you can still do chain of trust SSL validation on a payload in the body of HTTP as you could to encrypt the entire HTTP connection as in the case of HTTPS.
The other technique that might be useful to register lots and lots of obscure domain names and rotate them regularly. Might cost a bit in SSL certs.