Better authentication would be very nice.

However, if you want to force SSL, you can do so using...
http://www.stunnel.org/

And a firewall. Setup stunnel to route all traffic to TWGS,
then firewall the regular twgs port to the outside world.
Then only ppl coming in via SSH could get in. You can
also use stunnel in reverse to get twxproxy and swath
access to ssh as needed.

There's no way you can know with 100% certainty that
someone is who they say they are, but you can add layers
of complication to the process. An email address and a
phone number, along with a call to that number, for
each person, would make it a lot more difficult to dupe
and stuff.

The problem with dual-key encryption is the need to
authenticate both parties via some previous trust factor.