Good question. There's a subtle but important implementation detail here. Note `getAuthenticationSatisfiedByPolicy` searches for _all_ authentications on the ticket to determine one that satisfies security policy. In the proxy case I was uncertain whether we should do that, so I limited it to just the authentication performed to grant the PGT. That is a proxy callback in most cases, which really seems orthogonal to the kinds of security policy of interest in MFA scenarios. Not really sure how to handle it. Suggestions welcome.