Kerberos assumes there's a out-of-band mechanism for bootstrapping and establishing trust with every participating server. More specifically: Every server needs

Kerberos assumes there's a out-of-band mechanism for bootstrapping and establishing trust with every participating server. More specifically: Every server needs to have a unique secret (symmetric) key, which needs to be known by the KDC. Distributing these symmetric keys is outside the scope of the Kerberos protocol, and often done manually. If you're performing cross-domain authentication, there's also another level of interdomain keys needed to create referral tickets, which are also symmetric and need to be trusted. This works well in an organizational setting, where everything in the known-world is centrally managed. It doesn't scale well to the entire Internet.