It has been shown that the getHeader API end point leaks information about unconfirmed blocks via its log bloom. I propose not allowing requests from anyone but the proposer by requiring a signature from the proposer's pubkey. If it’s profitable, searchers and builders have an incentive for block proposal to be as delayed as possible (flashbots/mev-boost#111).
In Flashbot's implementation, the signature would be verified here:
https://github.com/flashbots/mev-boost-relay/blob/cf6fd5bdba0df0ef50b3f4afb0bb7162bcf09b8a/services/api/service.go#L1162