It seems to me like you're reinventing the wheel with your XML file solution. The web.config is alright for this. Maybe you should explain your man in the middle attack fears.