Just finished implementing support for receiving Private Webmentions in https://webmention.io and my website! If you're using webmention.io, you will notice a new "private" property when you list mentions or get callbacks.
When you send a private webmention for a comment on one of my posts, you'll see the comment counter increment but you won't see the comment appear. When I log in, I will see the comment along with a little "lock" icon so that I know it's a private post.
The thing I was most excited about at IndieWebCamp Brighton was coming up with a Private Webmention extension to Webmention. The version we outlined in Brighton was drastically simplified from previous iterations of potential ways to send private Webmentions.Nearly a week after speccing it out, I now have a first draft implementation of sending. My goal this week was to finish implementing sending private Webmentions, to get some real-world feedback on the spec.
Funny you mention that private webmention is daunting to implement. For me, the opposite is true. While I haven't actually implemented it yet, I feel like making private webmentions work is just figuring out the mechanics of doing the token exchange at this point. The real struggle is figuring out how I want the UX of private posts to work when you're logged in to my site. Should you see additional posts on my home page because you're signed in? Should there be a separate place you go to see private or semi-private posts? Should I only post private posts in separate "channels"? How should the post visually indicate that it's not public? Do I want people to know that they're viewing this post because they're part of a certain group, or leave that information hidden?