After looking through the IMAP code, I am wondering why RoundCube uses it's own homegrown IMAP code rather than the IMAP extension that is built into PHP 5.
The current IMAP extension fully supports all the forms of authentication supported by the current code, as well as additional ones such as GSSAPI[for example,the pubkey/kerebos token question earlier]. As such, if RoundCube has moved to PHP5 only, it would make sense to move the the IMAP extension.
I'm modifying the core code for my own use, including migrating those libraries to use PHP's Imap extension as a configuration option - once done I can certainly provide the patches if you want to add that code back to core.