8350f34a05
Merged from Apple branch: when the Win2K PKINIT compatibility option is set, do not require krbtgt otherName to match when validating KDC certificate.