Okay I figured it out. The secret passphrase needs to be compatible with an SMTP username; it cannot contain any special characters that a password generator may come up with. The attached PDF is a how-to, with screenshots.
I use
Interlink Mail & News - a modern and actively developed incarnation of the Thunderbird-style technology base, built on a modern and actively developed incarnation of
UXP, the best application platform from the Mozilla of old.
Interlink is much more capable of handling my demanding email usage than recent versions of TB, and doesn't crash nearly as often.
To clear up confusion above, *reading* from a news server uses an NNTP port on an incoming connection, while *posting* to a news server uses an SMTP port on an outgoing connection. This does *not* mean the server accepts email. Both connections can be an SSL port or a non-SSL port.