The bloat is the tlsClient/tlsServer.

I'll have to figure out the CRAM-md5 problem.  That code
looks unchanged from January.   What error do you get?
Does the '-d' option to smtpd put anything useful in the
log?

I'll set up a server that does authentication later today
and find a system to test it with.