It seems that if I have KDC transited policy checking disabled, I probably don't want krb5_rd_req as called by the TGS to check my policy. Does it currently work this way or do you start running into problems if you have more than three realms involved in a transit path?