I am not sure if it's right to automatically checkout submodules for the root package. In general, SwiftPM avoids performing git operations on the root package (there might not even be a git repository).
An alternative solution might involve using URL rewriting provided in Git. We use this on developer machines to rewrite all SSH connections to HTTPS for GitHub to deal with restrictive proxies.
.netrc support being discussed here also: SPM support basic auth for non-git binary dependency hosts.