Are private S3 assets possible? Is it possible to have an asset source pointing to a non public S3 bucket? Maybe also with expiring link urls?
Private buckets can be used, but files uploaded to them via the Craft CP will be given public read access. Expiring URLs are not built into Craft because the files being public.