Oh, I was't very clear on that. The sigs are on the inbound xml to verify the identity of the entity submitting the command.

Update: Looks like we're gonna have to decide to roll our own. SOAP doesn't seem to be anything we want, and I can't find this myserious XML::RPC (not that I have any idea what it is anyway). Anyhoo, I can't see any clear advantage of SOAP over use CGI; use XML::Parser; since that'll be a lot simpler. Well, unless anyone else has any other suggestions... I'm certainly open to it.