With Alonso's "help", I merged in restricted channel support to @librecast today.
This lets a receiver set a filter on an inbound #multicast channel with a keyring and capabilities.
Any traffic arriving must be cryptographically signed and have a token signed by a key on the filter keyring, and have the required capability bits set, otherwise it is silently dropped by standard API recv calls like lc_channel_recvmsg().