Currently, all pam_conv messages that are presented to the user must occur before open_session. Any after that are discarded.
This should be fixed so that we are true to what PAM wants, exposing any post open_session messages as needed. This will likely result in the "start" protocol message being able to return questions as needed.
Seems like logind conflicts with this idea a bit when a single VT is used for everything.