Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.420 (Entity 5.420)
RT-Send-CC:
X-RT-Original-Encoding: iso-8859-1
Content-Length: 262

A correction, for posterity:

RFC 4120 does actually specify the key to be used for ap-req checksums,
including for TGS reqs, in the list of key usages (7.5.1), and I missed
that on my reading.  (It should probably also be specified in the text,
but it's there.)