[merb]

because I know several "security" appliances where their http/https proxy only allows authentication via NTLM. And SPA (Exchange) still uses NTLM. And also Windows AD falls back to NTLM if krb is not available.

[youdontknowtho]

For a long time you couldn't setup a domain trust without NTLM.