Welp, I've implemented some hash token bucket situation, which is a decent practical solution. Thinking about this more, I guess a PSK-based solution could exist outside of Noise-proper, and amount to something along the lines of MACing with a nonce and keeping track of potential replays. Not very pretty I suppose.