Phew! Got SSH+GSSAPI working at last. Time for the obligatory English joke: When it works, #Kerberos is just the ticket.
So when I said I got it working, I meant I broke saslauthd instead.