A correction, for posterity:

RFC 4120 does actually specify the key to be used for ap-req checksums,
including for TGS reqs, in the list of key usages (7.5.1), and I missed
that on my reading.  (It should probably also be specified in the text,
but it's there.)