cryptonector and I also specified a Kerberos-like protocol [1] based on Mozilla’s defunct BrowserID protocol. I demonstrated it as a drop-in replacement for Kerberos with Exchange, having built a Windows SSP and credential provider as well as a GSS-API implementation (the latter which is open source [3]).
Unfortunately after Mozilla cancelled Persona, this never went anywhere.
[1] https://datatracker.ietf.org/doc/html/draft-howard-gss-brows...
[2] https://hacks.mozilla.org/2013/04/mozilla-persona-for-the-no...