apparently chrome on android supports kerberos via WWW-Authenticate: Negotiate, but only if you explicitly enable it, and you can only enable it by setting a policy option, which is only possible as a device policy controller, and then it also needs a third party app to talk to to actually perform all the gssapi stuff
holy overcomplicated