At one point, wasn't there an XBlock that implemented the client side of an LTI connection, so that the server side of the XBlock could be written as an LTI Service endpoint? If the endpoint is secured, the LTI call could embed whatever arbitrary information the client-side code can extract from the Python runtime. (Here "client" actually means the server-side piece running on
edx.org, which would essentially become a proxy/shim that forwards calls to the "real" server implemented as an LTI Service endpoint, if that makes sense.)