While we would like to support Kerberos over SSH for authentication, a license incompatibility with other components we are distributing means that we cannot recommend using the net-ssh-krb gem for this functionality.
After thinking about this a little bit more, I've realized that I can't use Bolt without this, as my environment uses Kerberos tokens for login to all servers, and having all users put private keys on all the servers isn't really an option.