This is now supported for subscriptions.
Pub/Sub now includes optional OpenID tokens with push requests. You can use those to authorize the requests. These tokens are natively supported by Cloud Run, with more services to come. Find out more here: https://cloud.google.com/pubsub/docs/push#authentication_and_authorization
and let us know if there are other things we can do to help secure the endpoints.