Comment by wiml

You still need to have privileges to become the userid of the user logging in. Openssh does do privsep, but you still need a privileged daemon.