Explain lack of binding to service principal

Sam pointed out that kdc-verifier doesn't bind to the service
principal name.  Greg analyzed this further and suggested that we
document it without making changes.