I just learned of this bug via the action needed list on tracker.debian.org/pkg/nsscache; nsscache and libnss-cache are designed specifically to handle the requirements described in message #22 and onwards, fyi.