Renaming the old 161 ebuild to 164 seems to do it. It has working pam_filter and support for service-based authentication.
in cvs now.
164 won't cope well with required certs, but 167 was released in December. It seems to work for me. Imo the ebuild needs ssl USE flag.
in cvs again.