Per-message services
The application transmitting a message calls a GSSAPI routine (sign or seal) to apply protection and send the result to the receiving application.
The receiver will pass it to a corresponding GSSAPI routine (verify or unseal) to remove the protection and validate the data.