If they can tell which pages are public vs private (which I think they can) they could just tell the client that they need a copy of the page when they are done rendering it, have it post the serialized DOM back to the server and then cache and serve that until the next redeploy.