We can shadow local displays like we do with NX/VNC displays.
The difficulty is in figuring out if that's really a wise thing to do... At least make it global option, preferably let the local user of that display decide (assuming he is running the client...)
We may also want to allow this local display to be exported to via a remote server, which complicates things quite a bit... (reverse SSH tunnel to that server - then another tunnel to the client...)
If we connect to a server and receive a "login failed" message and we haven't got a password, popup to ask the user.
Make it throttled and a configurable option (that can be toggled from the popup) to prevent being DoSed by fake local mDNS servers swarming us.
Maybe we shouldn't even try to login if there are no ssh keys and no password.. (alert user? or ask for password?)