I understand the idea and the confusing default state, but this would make it impossible e.g. to only install it with cy2-gssapi if that is the only authentication mechanism you need.
I would merge these packages with security/cyrus-sasl using the options framework to enable by default the most common authenticators. Users with special constrictions could then disable what they don't need. Just my opinion, anyway. Regards. adr