It turns out krb5-23 are just NT hashes. Drop the krb5-23 format
(it was a lot slower) and change kdcdump2john.py so it outputs
$NT$ tags for those.