Can't you serve it out of your domain, accessible only with an API key? This is pretty much what all map services do, and is a pretty well established pattern.