How can Jenkins on Linux do builds to Windows servers securely without A.D.?

You can configure each Windows server to be a Jenkins node (aka "slave" or "agent"). Then use a pipeline job to control the flow of which commands runs on which node (using node{} blocks).

This will eliminate the need for WinRM, SSH or other remote execution methods.

Securing the Jenkins node-to-master communications can be done using a per-node secret, managed by Jenkins. I do this with ~20 different machines, most Windows-based, some Linux-based, including complex build jobs that require parts that build under Windows and other parts that build under Linux.

Example pipeline code:

node("LinuxBuild") {
    sh """
        ls -l
        echo "Running under Linux!"
    """
}

node("WinBuild") {
    bat """
        dir
        echo Running under Windows!
    """
}

In the above code, LinuxBuild and WinBuild are labels given to one or more Linux or Windows nodes, accordingly.