Serialization framework future

[Sam Hartman]

I don't think the authorization data is important because it's
inherently incomplete.
Remember that the client never receives authorization data added by the
KDC, only the data it requested.

What's the use case here? How important is exporting acceptor creds?
I'm trying to evaluate the tradeoff between completeness and something
that we could standardize so you could reasonably import creds between
two different krb5 mechanisms.