author here, note that my view has somewhat changed from that which I held in 2009 from "it's silly" to "we'll do it if when we solve a few problems first."

PKI deployment in a semi-untrusted environment is still very difficult.

freenode messed it up by sharing their private key between all irc servers, which are hosted on other people's hardware. they had servers compromised in this period, and no forward secrecy enabled, so any TLS traffic captured over those multiple years has been effectively compromised.

presumably this was done to save money on CA fees, a problem that's gone away now that letsencrypt exists.

note that when I wrote the article the general assumption was that openssl was a reasonably good piece of software... not many people hold this view today.

an ircd isn't as easy to upgrade as nginx, upgrading them each time there's a new openssl vulnerability would make for a very splitty network.

separating the tls termination from the ircd (and locking it in a seccomp sandbox) would allow it be restarted independently... and is in progress.

(re: nickserv passwords, our channel service supports CRAM-MD5, so that isn't really a problem)