Thanks to the #debian IRC and this bug report I finally found out why on all of my Debian machines I couldn't use gnome-screensaver nor xscreensaver anymore since Squeeze (and now also a Squeeze installation dist-upgraded to Wheezy). Someone pointed me to this report.
So yes definitely the error needs to be reported in auth.log and if possible also returned to the application asking for the check. What I wanted to add here though is that there must be some application messing up the permissions. Group "root" on /etc/shadow has happened for me on various Squeeze machines, including one freshly installed from scratch just recently. It's definitely not (just) from a messed up upgrade. Cheers.
