
We can't test the key rollover support in the TGS in the x-realm path using just Heimdal because the krb5_get_creds() path will try a referral, which will produce a cross-realm TGT that has the enc_part.kvno set. But we can test this for the plain TGT case.