Implement authentication for Windows -> WSL connections

Is your feature request related to a problem? Please describe.
I'd like to use WSL for "sensitive" projects, however the lack of protection of the guest (WSL) from the host (Windows) gives me a pause.

Describe the solution you'd like
A proper solution should authenticate both types of connections:

1. Getting a shell inside WSL using wsl command
2. Fetching a file over \\wsl$ paths

Ideally, (1) should use SSH auth, which would enable use of gold-standard authentication options like GPG smartcards etc.
This is similar to how alternative products like Vagrant operate.

Describe alternatives you've considered
Alternatively for (2), there should be a way to disable \\wsl$ paths altogether, such that Windows clients cannot read arbitrary files from the WSL filesystem without authentication. Presumably, we would then be able to fetch files with (1) only.

Additional context
As mentioned, Vagrant SSH is what I'd like this to be more like. It enables the use of authorized_keys file on the guest, which makes it possible to use manually-approved passwordless auth with a GPG token, thus protecting the guest from unattended leakage of sensitive information to the host, while simultaneously preventing credential leakage from the host.

The issue names no files, tests, or implementation entry points. Start by tracing how wsl shell connections and \\wsl$ file access are handled, then determine the existing authentication boundaries. Done would require an agreed design that authenticates both connection types or clearly defines how unauthenticated \\wsl$ access is disabled.