Nicolas Williams writes:
> On Wed, Jul 23, 2008 at 02:01:43PM -0400, Michael B Allen wrote:


>> Extracting the keys from AD is not possible [1].


> Nor ist it possible to extract them from MIT krb5 KDCs.


It is as of 1.6 using kadmin.local (not that this changes the rest of your
point).

--
Russ Allbery (rra@stanford.edu)