We sort of have NegotiteStream to allow mutual Kerberos authentication. However, that is custom .NET extension and it does not work agains endpoint written in other languages.
For example #60906 caused crashing regression because SqlClient depends on runtime internals and it is hard to keep in sync.
Similarly PostgresSQL writes custom wrapper around NegotiateStream to strip and add fields to make it usable.

It would be nice to have enough public API surface so projects like this can use .NET directly without jumping through weird hoops.
We would need to work out details and either extend NegotiateStream or come up with separate stream class.