But Mario is correct that knowledge that the oid of the
root is the critical shared secret between the client
and the server.

Although I do think the idea is interesting,
I don't think the oid space should be made sparse
so that you can run a storage server on a public interface.
I don't think you should run a storage server on a public
interface.

If I had control of a machine on your network, I would
look at the first command a client sends,
the one where the root oid is transmitted.