Umm, cvs has native GSSAPI support, or it did when I left cygnus (5 years ago or so?) Nonetheless, I'd recommend "cvs over openssh with gss support" instead.