If I have a private URL that ends in ".html", it'll still likely get indexed.

It's not likely, it will get indexed for sure. I don't think this is meant as a finished solution but to show a general way how to do such things.
I am afraid however, there will be more cut & pasting than actual reading.