Tight encoding and a new approach to proxying
I also had an interesting thought about how this should all work within Xen. I was envisioning a single daemon that was told to open a PTY and listen on two sockets (one for the incoming connections and one for the reverse connection).
I'm now thinking that a much more generic proxy is a better answer. The idea would be to have a VNC proxy that can be given an arbitrary number of VNC connections to multiplex (that are normal or reverse). A config file of some sort could define the key bindings used for switching. The key bindings would obviously have to be directional (alt-f7 to go from session 1->2 and ctrl-alt-f1 to go from session 2->1).
I would then just implement a VNC terminal program and run that as a normal VNC server.