simpleindex looks like a very good solution indeed. Too bad the request project name has to match the distribution name, so one can’t create aliases like these:
[routes."abc-{subproject}"]
source = "http"
to = "https://user:pass@private.domain.org/simple/{subproject}/"
(otherwise, one gets Skipping link: wrong project name messages from pip -vv and no candidates are found)
Still, I’m really glad this project exists 
Looks like the simple solution I was looking for!