Update for Greg's comments

Minor wording changes.

Allow omission of kdc-verifier, subject to some security
considerations.