I don't recommend anything anymore there, network operators do that now
(ask at \#freenode and they will suggest SASL as reads at
https://freenode.net/faq.shtml#identify ).
Also mention that SASL is SASL PLAIN and to use SASL EXTERNAL you simply
configure CertFP + explain difference between the two mechanisms.