Note that at the ASN.1 level, an optional string that is present but empty is different from a string that is absent. I think that for Kerberos as it stands today, this change is probably fine, but it is possible someone will want to distinguish these cases.