>I.e. without it being a PITA, it would be *so* nice to have the options of
>
>	credauth(USER, username) -> pam.auth[USER](username) ->
>		BSD_authmod(username) -> getpwnam(user)

I don't really have a problem with this, FWIW (as long as I'm not the one
that has to write the unspecified shim layer).  But I'm not sure how you're
going to deal with PAM's conversation functions.  But if that gets worked
out, I'm happy, BSD auth people are happy, and the "I don't want PAM on the
system even though I can't give a good reason why" people are happy :-)

--Ken