There's already lots of work that has been done on XML app server stuff. Look at SOAP and SOAP::Lite and XMLRPC::Lite. I'm not sure how signing would play into this scheme, although it seems that you may be able to sign it using a filter on the outgoing response.