Surely there must be a solid reason why endpoint authentication and transport encryption must be extricably combined into one program.

Personally, I would find great use for the authentication function of OpenSSH as a separate program. In other words, a program that does one thing only: it verifies an endpoint is who it says it is.