Currently, we use a vendored k5test. I've extracted k5test (https://github.com/pythongssapi/k5test) and placed it on PyPI, so it should be fine to switch to using that and remove our vendored version.