Perhaps this is asked too late, but what if shibboleth support was added to Moodle? This would provide support federated authentication authentication, rather than simple SSO. Doing this may kill a number of birds with one stone.
MartinL says: We considered Shibb very carefully -- we really wanted to use it. But it involves a complex daemon acting as the IDP, it's not something you can "just install and run" like Moodle. A high requirement for Moodle Network was that installation had to be (relatively) simple and available even on simple/cheap hosting. And talking with people that look after Shibboleth installations was... interesting...