Yeah, Brian, the javascript way can work too, though you're right that we want to avoid the dependency.
There's a way to use a hash, much like ad_sign but instead of using the optional expiration parameter, the hash expires on next read automatically. I was mixing up the use of ad_sign versus a proposed (pre-TIPing) addition to it that was never added.
I'll see about making a working example for ecommerce that doesn't affect acs-core.
cheers and happy new years!