I agree with you on auth part, especially given that signer apps can have special cases for file uploads like "sign uploads auths for this hash for any server for 5 minutes"

And I am in Spain too, beers sound nice