The problem as stated is fixed by #7665, which will cause registered kdcpreauth modules to be offered before in-tree modules (and will also cause PKINIT to be offered before encrypted timestamp). There are other improvements to be made in this area, but they can have separate tickets.