2 -- in order of preference
4 - client: support KRB5_PADATA_ENCRYPTED_CHALLENGE in lib/krb5/init_creds_pw.c
5 - client: don't support ENC-TS in FAST
7 - client: plugin support for fast plugins
9 - kdc: plugin support for fast plugins
10 partly done with "struct kdc_patypes"
12 - kcm: support FAST armor ticket
13 -- using PK-INIT anonymous
16 - client: tgs-req fast support
17 - kdc: tgs-req fast support