Kerberos v5 tickets and X509 certificates support forward dating.  If we
are deriving identities from them, we should account for forward dated
credentials and forward dated identities.  This will have implications for:

    - Credentials display
    - Renewals