Well, it will become mor transparent over time. MIT Kerberos 1.8 has enough support that PAM modules, etc could use FAST when available. In a future version I'd like to see support for using anonymous pkinit (present in 1.8) to get FAST armor tickets automatically. - --Sam