I'm not directly interested in skylark, and this maybe off-topic, since Honza ruled out the OauthX protocol, but as for a client-side authentiacation mechanism, I was playing with the OAuth2 protocol and already wrote an experimental Auth package.
Currently it can authenticate using Google Accounts, though the current implementation is somewhat hacky (since we don't have any web/html engine, I had to use workarounds) and not for production environments.
But if you are interested in it, I can redesign tha package it and publish it around this summer. (My main goal is to implement OpenID, which is built on top of OAuth2)