askpass program for libpq

I would like to have something like ssh-askpass for libpq. The main
reason is that I don't want to have passwords in plain text on disk,
even if .pgpass is read protected. By getting the password from an
external program, I can integrate libpq tools with the host system's key
chain or wallet thing, which stores passwords encrypted.

I'm thinking about adding a new connection option "askpass" with
environment variable PGASKPASS. One thing I haven't quite figured out
is how to make this ask for passwords only if needed. Maybe it needs
two connection options, one to say which program to use and one to say
whether to use it.

Ideas?