I'm setting up my own personal mail server as big tech companies are getting evil each year. I find the username-password method archaic and insecure for something as important as email. What are my options? I like the concept of "access keys" from Amazon IAM. I also don't mind using PKI for email settings. The point I'm making here is that I want something that's not brute-forcible while revocable in case something goes wrong just like CRL. I know that IMAP is flexible because it supports SASL+GSSAPI, but the question is whether there are implementations I could use on my Android/IOS phones and PCs.
If we take Dovecot as example, below are the supported authentication mechanisms: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/
I think nowadays multi factor authentication and/or OTP offer better security compared to password login (regardless of the password storage backend). For example OTP and SKEY, OAUTBEARER or XOAUTH2.