Love, do you have code to implement the cross-realm part of this change in MIT krb5? (Corresponding to r23846 in Heimdal which strips ok-as-delegate from cross-realm tickets if the TGT ticket didn't have it.) If not I will do it myself this week; I just want to make sure I'm not duplicating effort.