Toby,

 

Using a view with keys should work. You can simply tell the Notes form to use an XPage when opened from the web. This is the way we built some of http://elguji.com. 

 

 

So the URL might look like: .../mydb.nsf/agDownload?openagent&file=/myview/mydoc/$FILE/myfile.txt

It wouldn't stop people who know how to construct Domino URLs from hacking the URL but it would cover 99% of the population.