“[…] if you add /rss?auth=digest to the end of the URL, and include the standard HTTP authentication at the beginning of the URL (username:password@ between the protocol and the server address), then the RSS feed will include the protected entries.”
This works for Thunderbird, which does support HTTP authentication for feeds, though apparently not HTTPS. You can’t view the entries this way, but at least do get the headlines.
…Except it seems to keep asking me to log in, although it does remember my id and password! That sucks.