rpcclient: support starting sign/seal with krb5/spnego