Hello Wendell,
I think the easiest way would be to expose method wich will return web.config
as string.
You will have more control over who can access it and could apply some other
restriction such hide specific sections if needed.

Hope it helps,
Oleg