When the caller has finished using the keyblock, he should call
\funcname{krb5_free_keyblock} to release its storage.
+\begin{funcdecl}{combine_keys}{krb5_error_code}{\funcin}
+\funcarg{const krb5_keyblock *}{key1}
+\funcarg{const krb5_keyblock *}{key2}
+\funcout
+\funcarg{krb5_keyblock **}{outkey}
+\end{funcdecl}
+Combine the two encryption keys \funcparam{key1} and \funcparam{key2} to
+generate a new output key \funcparam{outkey}. \funcparam{outkey} is
+filled in to point to the freshly-allocated key. When the caller is
+finished using the \funcparam{*outkey}, it should be freed with
+\funcname{krb5_free_keyblock}.
+
\subsection{Other data elements}
In addition to the above listed function entry points, each encryption
system should have an entry in \globalname{krb5_csarray} and a