>can you account for the fact that in order to verify digests, the server actually needs to store the plaintext of the password, and not a hash?
That was my first thought too, but apparently doesn't have to be the case. http://en.wikipedia.org/wiki/Digest_access_authentication#Ad...
On the other hand, wikipedia also points out my other gut reaction to the article, which is that forms over https basically provide all the same advantages without most of the drawbacks.