One more update: it seems that the firmware needs to be in sync. I ended up using the wireless-2.6 kernel from the everything branch.
I just managed to get my wlan from my laptop to work with WPA2-PSK with AES with the free Broadcom driver (now named b43, formerly bcm43xx).
In order to do this I needed linux 2.6.24-1 from unstable and the b43 driver.
0b:00.0 Network controller: Broadcom Corporation BCM94311MCG wlan mini-PCI (rev 01)
0b:00.0 0280: 14e4:4311 (rev 01)
bounty:/home/eddy# lsmod | grep b43
b43 119976 0
rfkill 12816 3 rfkill_input,b43
mac80211 132236 1 b43
led_class 10120 1 b43
input_polldev 9872 1 b43
ssb 39428 2 b43,b44
pcmcia 45720 2 b43,ssb
pcmcia_core 46500 2 b43,pcmcia
firmware_class 15232 2 b43,pcmcia
This is the wpasupplicant.conf file that I used:
bounty:/home/eddy# wpa_action wlan0 reload
wpa_action: reloading wpa_supplicant configuration file via HUP signal
bounty:/home/eddy# cat /etc/wpa_supplicant/wpasupplicant.conf | grep -v '^\s*#' | sed 's/psk=.*/psk=aaabbb___ENCRIPTED_SEE_wpa_password___cccddd/'and this is the relevant interfaces area:
iface wlan0 inet dhcp
This is what it looks like when is working:
And here's the result of a scan (relevant section):
bounty:/home/eddy# iwconfig wlan0
wlan0 IEEE 802.11g ESSID:"toblerone"
Mode:Managed Frequency:2.412 GHz Access Point: 00:1B:FC:45:33:70
Bit Rate=48 Mb/s Tx-Power=27 dBm
Retry min limit:7 RTS thr:off Fragment thr=2346 B
Encryption key:1337-0000-C121-d73D-0207-RE41-0000-3210 
Link Quality=98/100 Signal level=-36 dBm Noise level=-68 dBm
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0
Cell 02 - Address: 00:1B:FC:45:33:70and here is proof it works:
Frequency:2.412 GHz (Channel 1)
Quality=93/100 Signal level=-42 dBm Noise level=-68 dBm
IE: IEEE 802.11i/WPA2 Version 1
Group Cipher : CCMP
Pairwise Ciphers (1) : CCMP
Authentication Suites (1) : PSK
Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 18 Mb/s
24 Mb/s; 36 Mb/s; 54 Mb/s; 6 Mb/s; 9 Mb/s
12 Mb/s; 48 Mb/s
bounty:/home/eddy# route -nWoooohooo! :-)
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.77.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan0
0.0.0.0 192.168.77.254 0.0.0.0 UG 0 0 0 wlan0
bounty:/home/eddy# ping debian.org
PING debian.org (126.96.36.199) 56(84) bytes of data.
64 bytes from gluck.debian.org (188.8.131.52): icmp_seq=1 ttl=36 time=201 ms
64 bytes from gluck.debian.org (184.108.40.206): icmp_seq=2 ttl=36 time=199 ms
64 bytes from gluck.debian.org (220.127.116.11): icmp_seq=3 ttl=36 time=200 ms
--- debian.org ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1999ms
rtt min/avg/max/mdev = 199.691/200.519/201.046/0.786 ms
Thanks to all people involved in b43 development and all the ones made this possible (Debian developers).
Posted from bed, via wlan.
Update: You need the firmware blob, which can be extracted from a Windows driver with bcm43xx-fwcutter (now called b43-fwcutter);
Update: it seems the b43 driver page (the entire linuxwireless.org site) went down sometime yesterday evening, since yesterday afternoon I was browsing through the site without any issues. (Note: I live in Europe, for reference)