I think you've got most of your problem solved -- at least in theory.
The answer to your questions of SSL and IPs is yes, and yes - check the
manual for details..
10,000 clients eh'. I hope you have some beefy hardware :-)
> Scenario 3 seems the most elegant to me. It avoids having to set up
> some sort of replication/copying scheme and having the same data stored
> in two different places. But we are understandably nervous about
> hanging that main db out there on the internet. So, I'm looking for the
> best recipe to minimize risk. Here's what I've thought about so far: