Doesn't http progressive download (over https) achieve this? I could be wrong, but I think if you just configure nginx with SSL and have the webcam dump to some sort of a raw file format, you should be able to download the file and since you're using SSL now it's encrypted. It won't be a true streaming server, but should be close enough.
You may need to have the client send a byte range header with each request to ensure you always start near the end of the stream so it's closer to realtime.
This doesn't satisfy either requirement: "encrypted video stream" most importantly, but also "[using a] plain file host rather than hosting some custom service" since a plain file host won't pull my https stream, I'll need to setup another service to do that. Or did I misunderstand what you meant? Either way, thanks for helping think of solutions!
You may need to have the client send a byte range header with each request to ensure you always start near the end of the stream so it's closer to realtime.