switch ( tagged.getTagNo() ) {
            case 0:// Kerberos version
                ASN1Integer tktvno = ASN1Util.as(ASN1Integer.class, tagged);
                if ( !tktvno.getValue().equals(new BigInteger(KerberosConstants.KERBEROS_VERSION)) ) {
                    throw new PACDecodingException("Invalid kerberos version " + tktvno);
                }
                break;
            case 1:// Realm

        return new KerberosKey(null, keybytes, etype, 0);
    }


    private static void checkBytes ( byte[] expect, byte[] have ) {
        if ( !Arrays.equals(expect, have) ) {
            Assert.fail(String.format("Expect: %s Have: %s", Hexdump.toHexString(expect), Hexdump.toHexString(have)));
        }
    }

            ASN1Sequence vec = (ASN1Sequence) constructed.getBaseObject();


                ASN1ObjectIdentifier spnego = (ASN1ObjectIdentifier) vec.getObjectAt(0);
                if ( !SPNEGO_OID.equals(spnego) ) {
                    throw new IOException("Malformed SPNEGO token, OID " + spnego);
                }
                ASN1TaggedObject tagged = (ASN1TaggedObject) vec.getObjectAt(1);

                if ( !pvno.getValue().equals(new BigInteger(KerberosConstants.KERBEROS_VERSION)) ) {
                    throw new PACDecodingException("Invalid kerberos version");
                }
                break;
            case 1:
                ASN1Integer msgType = ASN1Util.as(ASN1Integer.class, tagged);
                if ( !msgType.getValue().equals(new BigInteger(KerberosConstants.KERBEROS_AP_REQ)) )

        }

        try ( ASN1InputStream stream = new ASN1InputStream(content) ) {

            ASN1ObjectIdentifier kerberosOid = (ASN1ObjectIdentifier) stream.readObject();
            if ( !kerberosOid.getId().equals(KerberosConstants.KERBEROS_OID) )
                throw new PACDecodingException("Not a kerberos token");


            // yes, there really is non ASN.1/DER data inside the tagged object
            int read = 0;