See also http://mailman.mit.edu/pipermail/kerberos/2015-September/020955.html