C library system-call wrappers, or the lack thereof

Or are you seriously proposing to go back to the old world where every new authentication mechanism required independently hacking every program that needed it? Because that is not going to fly with anyone with remotely complex needs (forget enterprise LDAP, even people with yubikeys will be calling for your demise :) )