One more thing I meant to mention: since your S4U tests are not integrated into "make check" (except for the ASN.1 encoder/decoder tests), you're on the hook to document how to run them manually in http://k5wiki.kerberos.org/wiki/Manual_Testing after this code is merged into the trunk.