krb5: Fix PAC signature leak affecting KDC