Embedding a Lightning .app is totally possible using any iframe based approach including Canvas. This is embedding a single page app though which is a very course grained approach which might be fine if the interaction is also course grained. We're actively working on Lightning Out to allow you to directly embed lightning components cross domain - they run directly in your DOM and automatically take care of cross domain (using CORS) communication, environment initialization, etc. Safe harbor target is Winter '16.
Lightning Out cross domain support is in Developer Preview in Winter '16. Lightning Components for Visualforce is GA in Winter '16.
Both of these features are component centric not app,ovation centric and do not rely on iframes for embedding in your web container.
There is currently an issue (actively being worked on) when you try to leverage LC4VF from a VF page running under Sites/Communities. There is a related issue when attempting to use LO with a guest user that we are also working on.
All of that aside have you tried using an iframe inside of a VF page to include the .app indirectly? I believe you might run into our anti framing/click jacking protection but that depends on the specific domain mix. This is a course grained approach and inferior to LO/LC4VF but might be enough to keep you moving.