There's already lots of work that has been done on XML app server stuff. Look at SOAP and SOAP::Lite and XMLRPC::Lite. I'm not sure how signing would play into this scheme, although it seems that you may be able to sign it using a filter on the outgoing response.
Oh, I was't very clear on that. The sigs are on the inbound xml
to verify the identity of the entity submitting the command.
Update: Looks like we're gonna have to decide to roll our own. SOAP doesn't seem to be anything we want, and I can't find this myserious XML::RPC (not that I have any idea what it is anyway). Anyhoo, I can't see any clear advantage of SOAP over use CGI; use XML::Parser; since that'll be a lot simpler. Well, unless anyone else has any other suggestions... I'm certainly open to it.