[tlyu - Fri May  9 20:06:30 2003]:

> krb5_mk_rep should allow for AP_OPTS_USE_SUBKEY to cause the
> generation of a subkey; this subkey should be sent in the AP-REP and
> set as the sending and receiving subkeys.

AP_OPTS_USE_SUBKEY is one of the ap_req flags, and krb5_mk_rep doesn't
take any ap_req flags.  A new auth context flag is probably what we
need, unless we want to add a new variant of the mk_rep API.