I wrote up some thoughts for the next release of DragonFly. There’s some project work in there for anyone interested. The next release should be near the end of May.
In my view PAM is a nightmare to audit. OpenBSD uses “BSD Auth” (http://en.wikipedia.org/wiki/BSD_Authentication) which is remarkably easy to use and extend.
DragonFly BSD Digest