I wish I'd known you were doing this. Yes, we do need preauth plugins for pkinit. I've worked up something too but it's half-baked at the moment. I will certainly take a look at what you've done.