Authenticate access to IPFS objects

I was thinking last night how it would work if we used IPFS for a private filesystem on a computer, possibly containing private data. The problem I wanted to solve is how to keep a file private when the IPFS protocol implies sharing the file hash with the world in a DHT.

Anyone looking at the DHT would be able to see file hash going around, and they might want to look at them. For example, search engines could do this to index the IPFS Web.

How to make sure that the private key file I stored on my IPFS filesystem will stay private then ? I was thinking of a way to require authentication of an IPFS node before it is allowed to access some objects marked as such.

If we allow arbitrary data to be stored in a node (using IPLD for instance) we could imagine linking any object to an ACL object, which would describe which authentication will be required before a node can grant access to the object. The ACL object will then contain a list of public keys (or link to those) corresponding to allowed nodes.

Now, when a node want to download this specific authenticated object, the owner of that object will first check that the requesting node has the private access corresponding to the public key in the ACL object.