Using certificates for SSH authentication

> There is no way (AFAICT) to use an SSH key as the credential with which to request a TGT.

Not out of the box but it's not particularly difficult to write. I did so at my previous job. Conceptually, it's just a simple ssh forced-command wrapper around kinit against the KDC as the backing store and then returning the resulting TGT for storage in a ticket cache. Maybe a week or two of work.

The hard part in all of these systems isn't the protocols, it's your chain of trust for how you get keys to users, manage them, and revoke them when necessary.