Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.427 (Entity 5.427)
RT-Send-CC:
X-RT-Original-Encoding: iso-8859-1
Content-Length: 566

Looking back through the archives, this is actually a conscious change:

http://mailman.mit.edu/pipermail/krbdev/2008-December/007154.html

Sam's reasoning was that wrong-key-version errors aren't very common, 
which I think is not necessarily true.

I think with a little bit of additional code, we can return a clearer 
error code in the non-alias case.

Sam also notes that gssrpc__svcauth_gssapi() uses KRB5KRB_AP_WRONG_PRINC 
to iterate over service principal names.  I think it's fine not to 
iterate in the cases where we'd produce a kvno mismatch error code.