[Cryptography] Does anyone here know PAM?

[grarpamp]

Generally, looking at PAM module for something like you seek 1) and 2)
is probably reasonable and reasonably cross platform. Beware locking
into coding for some specific platform "desktop environment" library,
vs looking at say how ssh-agent auth socket style as more cross
platform, even if the env var is still present the socket is gone
and memory wiped from underneath. Your larger effort will be around
defining your API in your listed item 3), and wiping all intermediate buffers.