It would be useful to have StringLoader and ImageLoader requests signed.

An example of such a scheme can be seen with Discord's webhooks implementation: https://discord.com/developers/docs/interactions/overview#setting-up-an-endpoint-validating-security-request-headers

For a proposed scheme: As there is no body, this isn't actually useful to add, but something like a X-Signature-Ed25519 that contains X-Signature-Timestamp (or a random nonce at least 192 bits wide - it would be the server's job to ensure that a given IP does not repeat the same nonce twice) and the signature be built out of both the X-Signature-Timestamp and a per-world key that is known only to the world creator (or even a key that belongs to the world creator that applies to all worlds) and potentially the actual request URI.

This would allow a world creator with stringloader-based integrations to validate requests coming from StringLoader are genuine, and the only realistic way one could extract the key is with a modified vrc client or other exploits - so this or something like this could be a great first step towards allowing more interesting multi-instance and external integrations without having to develop complicated challenge-response style schemes, and would generally allow for more flexibility and faster update rates as a result as requests would not be burned just performing said challenge-response operations.