Ævar Arnfjörð Bjarmason [off-list ref] writes:
I think per
https://lore.kernel.org/git/87o8ejej8m.fsf@evledraar.gmail.com/ (local) that
this may not be much of an issue in practice, i.e. assuming that most
modern servers only accept auth over the encrypted channel the user will
get an error anyway.
Let's see how it goes. It may be wishful thinking but it would lead
to the easiest/simplest solution.