We're constantly working on improving datastore performance, but asking for a factor of 10 improvement is outside the bounds of reasonableness: that would bring latencies well under that of a disk seek, so unless you're prepared to pay to have all your data stored in ram, it's effectively impossible for reads.
MitM attacks are a legitimate concern. I have an open bug to implement straightforward RSA signing of menu responses, with validation in the gPXE code, as well as to have gPXE hash check downloaded images. The reason I don't simply want to use SSL is because I don't trust gPXE's SSL implementation - you wouldn't either if you'd seen it - or my ability to fix it properly.