Another option would be to migrate towards using the krbtgt principal to authenticate. (This would essentially require using the KDB keytab as suggested in #8299.) Such a change would greatly simplify the setup required for propagation, but would present transition issues.