Sounds reasonable.  I'll suggest a slight variation.  We change the authobj signature to challenge=None, then the first thing we do in auth is 'initial_response = authobj()'.  The return value can be the empty string or a real initial value, and we send the auth command with ' '.join(mechanism, initial_response).strip().  Then we do the challenge part only if we get the 334.

There's already an open issue for smtpd auth, with at least a preliminary patch, but it got blocked a bit by Martin quoting an RFC...