There is already BSD Auth, which has the advantage that it allows for sandboxing, while PAM doesn’t due to its use of shared libraries (instead of separate processes), which the author of TFA claims is not problematic. Yes, it is.