doesn't this require the NAT to use the same inside<->outside
address binding for the connection between the client and the KDC as
for the connection between the client and the application server?
e.g. it seems like the NAT could easily change address bindings
during the lifetime of a ticket.
True. However, the same problem applies without NAT if the client
changes address bindings, so I wouldn't say this is really a
NAT-related problem.