drop backported PKINIT fix: directly-trusted KDCs
    
    - drop backported fix for teaching PKINIT clients which trust the KDC's
      certificate directly to verify signed-data messages that are signed with
      the KDC's certificate, when the blobs don't include a copy of the KDC's
      certificate