Eureka!
I have managed to get a BCM50 Release 2 to communicate with an authenticating public SIP trunk provider (Voiceflex, in case you are wondering.) Now, neither Voiceflex, nor Nortel support this. According to our suppliers, nobody else is doing this. But, by putting Asterisk in between them (which Voiceflex seem to be using too, judging from their voice prompts), I have the BCM50 working fine on Voiceflex’s SIP trunks.
Now all I need to do is get it up and running on an NSLU2 or similar.
Watch this space to find out how it goes at a client site.
UPDATE - Voiceflex now do support this - if you are connecting from a static WAN address, they will allow connections from this IP without authentication if you request it. If you are using the BCM50 (this includes release 3), this will work for you - unless you have a dynamic WAN address, in which case the technique mentioned here is still useful.