Ah! I think you may have hit this.
TLDR: TLS needs to be enabled for the SASL config to work. However some fool (me) decided to be too clever about that, so we don’t have an ‘enable TLS’ option. Instead, Snowbridge will enable TLS if it is provided the required files. In retrospect that wasn’t the best idea.
So for the moment you have to provide valid dummy TLS files in order to coerce it into working.