In addition to discoverability of the authentication mechanism being low, there also appears to be misleading information in the relevant documentation.

The SceneMultiplayer authentication docs (specifically the docs for peer_authenticating and complete_auth) seem to imply that any given peer does not receive the peer_connected signal for another peer until it has authenticated with that specific peer (by both of them calling complete_auth on each other's peer IDs), but that is not what is happening from what I can tell.

I can only see the authentication handshake happen between a client peer and the server, and once the authentication with the server has completed, peer_connected signals are emitted for all others peers on a peer, even though complete_auth was never called for those peers.

I'm not terribly familiar with the godot source code, but that also appears to be what is happening. _admit_peer checks if the server is calling the function, and if so, forwards peer IDs to other peers. Clients receive this message, check that they aren't the server, and that the message came from the server, and then add the peers. The comment in the code also indicates that these peer connection messages are just being relayed over the server (if relaying is enabled), and the clients automatically accept the peers, without authenticating first.

Ideally the previously mentioned documentation can also be updated as part of this PR to make the entire mechanism more clear.