We intend to have this information replicated or transparently available in one of approximately 15 'megacenters'. However, if the repository and credential information require the same protection in transit, then host sharing might make sense.
Additional comments inline.
I think that's our basic assumption. Not sure what you mean here. If yes, connecting to a secure web server should automate server authentication by the client. If the data in the repository is secured such that only the credential server can access it, a secure channel between the two is somewhat redundant. After a little reflection, I think I may have dived into implementation issues a little early.