Comment by Nextgrid

Isn't Kerberos explicitly designed to run over untrusted networks and not require any additional transport encryption?

You could argue that the common implementations are large piles of legacy C with questionable memory safety that could open them to exploitation by malicious actors, but that's an implementation detail rather than the protocol itself - and I believe there's at least one (mostly?) memory-safe implementation in Java called Apache Kerby.