An "easy" way to do it would be to
extend STARTTLS to "STARTTLS required_target", but this would in fact
change the protocol.
I'd be amenable to a "MULTIDOMAIN" EHLO keyword, with the following meaning:
(1) If STARTTLS is also advertised, a domain name SHOULD be supplied as an
argument to the STARTTLS command.
(2) If AUTH is also advertised, then usernames of the form "user@domain"
are supported and recommended for authentication.
(3) If neither STARTTLS nor AUTH is advertised, the keyword is ignored.