Could you document somewhere exactly what is going on in this Sasl authentication? As it stands its a little confusing to me how this works since there are a few layers of indirection between this and what goes over the wire. It seems to me that basically you are converting the private key into a Sasl password and then relying on Sasl's authentication to agree the password matches on client and server. Some high level description like that would be useful.

Another thing I'm wondering about is - does this encrypt the over-the-wire connection or just send the hashed password in cleartext?