@droazen:
The main requirement is that the APIs need to allow you to optionally pass in URIs/Paths for all of the "companion files" for a particular input. For example, the fai and dict files for a fasta, or the bai file for a bam. When using signed URIs for authentication, these would all have separate signed URIs that would need to be provided explicitly.
Of course, there should also be API methods that don't require you to pass in all of the companion files, and instead infer them automatically from the Path to the primary input, as htsjdk currently does. We would use these whenever possible (eg., when using account-level authentication rather than signed URIs, or when no authentication is necessary).
@droazen: