Previously we said: "There would be some robustness advantage in having the slave KDCs on site wires, rather than on B aka Transit aka .64 ..." On further reflection, this probably isn't worth it. The gain would be in external visibility, but routing failover should cover it in most cases. Internally each site's local KDC is accessible through the site's own routers, so partition wouldn't be such an issue. We do just have to be a bit more careful while KDCs are down (for upgrades and the like). For simplicitly, then, just leave the KDCs on B.
The iFriend KDCs coexist at the moment with the cosign servers, so there'll be some coordination needed there too. Fortunately this time it's with ourselves!