seriously "kerberos doesn't work well on the web" is like saying "cars don't work well on the road"

browsers could make it easier to approve domains for spnego (chrome already makes it automatic for enterprise accounts). the market just doesn't want real security, it wants to login with its facebook profile.