- backport patch for RT#7046: tag a ccache containing credentials obtained via S4U2Proxy with the principal name of the proxying principal (part of #761317) so that the default principal name can be set to that of the client for which it is proxying, which results in the ccache looking more normal to consumers of the ccache that don't care that there's proxying going on
    - pull in patch for RT#7047: allow tickets obtained via S4U2Proxy to be cached (more of #761317)
    - backport patch for RT#7048: allow PAC verification to only bother trying to verify the signature with keys that it's given (still more of #761317)