than seven days away when the KDC reports it via the last-req field, just as we already do when it reports expiration via the key-expiration field (#556495)
