There are various talks online about ClickOnce improvements in Orcas.  I installed a Vista Virtual PC and Orcas Beta 1, which took a rather long amount of time since I had work to do on this PC while VPC was fighting for resources.  Details were scarce but I had hoped the gaping hole of no authentication mechanisms being supported by ClickOnce would be in some way addressed out of the box with Orcas and .NET 3.5.  No Joy, at least not without a little bit of work and digging.  There are references to the ability to customize the User Interface you see while downloading the application files, ostensibly for branding but I have some hope that this may also allow one to provide a user interface to responde to an authentication challenge.  If not, I'll begin brainstorming some kind of frankenstein solution that may end up being no easier than home rolling the whole shebang.