Can I minimize maintenance of duplicated Windows + SQL Auth logins? In our environment, SQL authentication is the norm, but Windows auth is possible when users are using RDP.  As a result, each physical user has two logical logins for each instance and two logical users for each database on each instance.

Is there any way to link two logins, so I can (e.g.) grant privs to both simultaneously?

This is a small thing, but seeing repetition like this triggers my "there's got to be a better way" sense:

CREATE LOGIN Bob
CREATE LOGIN Domain\Bob
ALTER SERVER ROLE serveradmin ADD MEMBER Bob
ALTER SERVER ROLE serveradmin ADD MEMBER Domain\Bob
USE Db;  CREATE USER Bob FOR LOGIN Bob
USE Db;  CREATE USER Domain\Bob FOR LOGIN Domain\Bob


Am I overlooking a feature that would reduce this duplication?

We'll eventually replace domain logins with AD groups, which will help.
I would suggest moving all clients to the domain and removing the SQL logins as the AD route is much more secure. If this is not an option then I would probably remove the AD logins and have RDP users use SQL logins as having two logins per user doesn't make much sense.

If for some reason you decide you have to go the two login route I would write a stored procedure to replicate the settings from AD users to your SQL logins. This could be triggered with a DDL trigger. This way you would only have to update one set of users. 

I would also be careful in using AD groups if you are not the only person responsible for the administration of the domain. It's not clear from the database who has the permissions specified for the group as users be dropped in and out of the AD group without your knowledge.