krb5_mk_rep should allow for AP_OPTS_USE_SUBKEY to cause the generation of a subkey; this subkey should be sent in the AP-REP and set as the sending and receiving subkeys.