Are we going to have issues with with mech negotiation re the ability to store auth data for >1 mech and access it early enough?
Presumably we'll need multiple digests for a user. For example if we want to allow the choice of mechs scram-256 and scram-512 we need different stored hashes for the same user in pg_authid. And we'll possibly need to be able to tell at the time we advertise mechs which users have creds for which mechs otherwise we'll advertise mechs they can never succeed. The client has no way to make a sensible choice of mech if some arbitrary subset (maybe just 1) will work for a given user.
There's no point advertising scram-512 if only -256 can work for 'bob' because that's what we have in pg_authid.
Yes, filtering the advertised mechs exposes info. But not being able to log in if you're the legitimate user without configuring the client with your password hash format would suck too.
