It would be sort of neat if someone would propose a design for implementing this in kadmin. It comes up often enough it is clear we need a solution, but no one here at MIT is going to get around to it anytime soon.