After seeing another session where the latency issue was dealt with by including Kerberos tickets in the SOAP headers, I'm pretty sure that that is the appropriate way of dealing with the integrity issue as well as the idempotence problem...