>> Is there a good argument against PAM
>
>1. lack of support for S/Key, KerberosIV, and GSSAPI.

A correction here.

GSS-API _explicitly_ does not deal with establishing initial credentials
which is _exactly_ what PAM is supposed to do.  So yes, PAM doesn't support
the GSS-API, but there's no way PAM could support the GSS-API.

I think PAM is a good thing, but it "needs more study".

--Ken