It doesn't help in the Twitter client use case, but it will help in the user/password compromise scenario described in the parent comment.

If I compromise the keytab, I can impersonate the domain member server and presumably the active tickets... but the username/password is on the KDC/DC.