What I've done is recreated a stdio-like interface sitting beneath all
command/data I/O in ftpd, which is responsible for all encryption/
decryption.  This layer sits on top of another net-layer, responsible
for all socket I/O...  Incidentally, the socket part fixes those
XXXLUKEM's about adding ratelimit support to ASCII mode transfers
(though I have my own XXX's about ferror).

I don't want to apply this before the branch, and I'd like to go over
my changes again and make sure everything's cool, but if anyone else
wants to play with what I've done, the patch is on
ftp://ftp.netbsd.org/pub/incoming/aidan/ftp-patch.tgz
It contains a bunch of files to add to src/libexec/ftpd, and a patch to
apply against that directory.

Any feedback on the style or implementation would be appreciated...  I
don't want to commit this before the 1.6 branch (I've been exceptionally
bad about getting NetBSD work done in a timely manner, and there are
~certainly bugs in there with all that's been rototilled), but it could
probably be pulled up when people are comfortable with it.

Thanks,
--aidan