Another option would be to add a --enable-deprecated flag and then require that along with --with-nss and other deprecated options. An opt-in to explicitly have to say "I know what I'm getting myself in to" and then we can use that same mechanism for gatekeeping other features on the way out?

That's not a bad idea, but I have to say that I like that the way I did it here needs the user to acknowledge this exact feature being deprecated and not accepting deprecation in general.

this exact feature being deprecated and not accepting deprecation in general.

Well I'm with you on that but --with-nss-aware doesn't say much to an admin glancing through their company's shell scripts. --DEPRECATED-with-nss or something

The flag name needs to start with --with for the configure option thing to work. --with-deprecated-nss perhaps?

I agree, something with deprecated in the name.

Uses --with-nss-deprecated now!