Managed cards backed by Kerberos: Create a managed card backed by a Kerberos ticket, import it into the selector, and use it at a relying party.