Not that the original article has anything to do with Kerberos other than design-by-analogy (not to knock the article, it's describing an interesting thing, and I'm always up for 90s nostalgia regardless of cause :-) but I think that version was more "MIT figured out that the change from ITAR to BXA and the published-code category made it reasonably safe for them to put anything up with a warning and possibly a registration". (CNS is the v4 release we shipped, which mostly got folded back in as an MIT krb4 patch release as well; we then shipped KerbNet which was V5 based, until we dropped the project entirely.)
Yeah, I went to Switzerland in one of your followup trips to meet with the arms-length-contract cryptographers. (Which was legal at the time, but a loophole that got closed a year or two later because Sun's "ELVIS+" project for funding a russian team to do non-US crypto got too much attention...)
