I ran across this while doing some work with the test suite, and I only have a shaky understanding of any of this code so it's possible I'm missing something.

#716 added this security flag which is supposed to allow explicitly enabling channel bindings for the GSSAPI mechanism. However, if I set this flag in the test programs it results in the GSSAPI mechanism being rejected when the library checks to see if it's suitable:

When I tried adding the flag to

and so that these checks could pass it appeared to revert to having channel bindings enabled by default. The only way I was able to get the tests working was to explicitly ignore this flag while doing the comparisons (flowerysong@1ba9678), which feels wrong.