krb5 extra rt: fix ASN.1
krb5 extra rt: use EXPLICIT TAGS!