macOS Sierra broke SSH Kerberos authentication
I asked this in the SSH mailing list openssh-unix-dev@mindrot.org and I got this answer:

The GSSAPITrustDNS was never part of portable OpenSSH. This option originally comes from third party extending kerberos support in OpenSSH, which is no longer maintained, but can be simply rebased on the current sources.
The problem in this case is Apple dropping this patch used by many people, so the Apple is the place where you should ask (or your OpenSSH packager of your favorite repository).

http://marc.info/?l=openssh-unix-dev&amp;m=147850754710753&amp;w=2
It seems that we have to ask apple to put this feature back.