Managed cards backed by Kerberos: Create a managed card backed by a Kerberos ticket, import it into a selector, and use it at a relying party. (=mbj)