On the desktop, WCF uses mutual authentication when using Kerberos authentication. We specify the servers SPN by adding the relevant SPN to AuthenticationManager.CustomTargetNameDictionary. We need a way to:

1. Enable mutual authentication
2. Override the SPN we expect the server to be using

The second item is needed if mutual auth is enabled as on the service side only a system process is able to use the host/hostname SPN. When the remote service is using HTTP.SYS in a non-system process and not using Kernal mode authentication, a unique SPN must be created and used. If mutual auth is enabled, this would break without being able to specify the SPN for the server on the client side.