If you had to secure requests to an authorization server, how would you do it?

In reference to Securing Requests from the Client Instance

What should be the defaults?

• Default to bound tokens with HTTP Message Signatures for both RS calls and AS grant negotiation, with bearer as explicit opt-in, or something else?

• For AS initiation, do you favor httpsig or jwsd in practice, and why? Any pitfalls with headers, proxies, or content hashing?