Actually, I came across Catalyst::Plugin::Authentication::Credential::NoPassword in the latest version, which is apparently intended for the purpose of sudoing. With a bit of fiddling, I was able to get it to work.