I'm aware that [Kerberos can use PKI](http://www.ietf.org/rfc/rfc4556.txt), PKI [provides encryption and authentication](https://en.wikipedia.org/wiki/Public_key_infrastructure), [Kerberos is designed more for authentication than encryption](https://stackoverflow.com/questions/111386/difference-between-ssl-and-kerberos-authentication), [Microsoft implements](https://msdn.microsoft.com/en-us/library/windows/desktop/aa378170(v=vs.85).aspx) the Kerberos KDC by "using Active Directory as its account database," and that Active Directory allows you to [use certificates instead of passwords](https://msdn.microsoft.com/en-us/library/bb742438.aspx). So if you're using X.500 directories and PKI, why use Kerberos? Couldn't you keep X.500 for non-Kerberos tasks (e.g., group membership lookups with memberOf) and replace Kerberos with PKI?