.... how do I limit visibility of Zope-served pages by IP address? I guess using an if tag and REMOTE_ADDR is one of of doing it but it seems sort of kludgey when Zope seems to have most of the intranet-type bases covered.

You can either use the REMOTE_ADDR variable in Zope or config the web server to precude some set of IP addresses from accessing, for example, http://server.com/Zope/* --Rob