Just a thought I've been musing about lately... Since a client (or service acting as a client to another service) must have the interface of the associated service in it's classpath (local and trusted), why cant the client express a dependency on that associated service's -dl.jar file(s), download and provision them from a trusted server (installing them locally) and use the downloaded (checked and verified) jars to load the classes the proxy of the associated requires?
This fits in very nicely within a Maven built project scheme, not sure if dependencies can be expressed (or derived) from an OSGi context, but do we need to have codebase services if this worked?