Since an event is fundamentally an entry with extra metadata, it's already postable to custom security groups in the original proposal. Likewise, since an RSVP is a comment with extra metadata, RSVPing can be restricted just like comments on any post. :-)

I like the idea of producing a custom group which is people who have RSVPed to a given event. Cunning.