We are getting ready to publish and we have people suggesting we force the client to download openvpn and use the vpn we setup for them after sign up. That's because people are getting nervous about exposing our API to the world like this.

Those who do that, what sort of infrastructure/setup/products are you using?