I'd recommend coordinating any such model with the upstream Kerberos implementations and with distributions.