Maybe what just needs to exist is an alum.mit.edu kerberos realm
that can be used for zephyring and AFS ACLs.
It seems totally reasonable for community members to be able
to continue to use zephyr and some other services,
like being able to be placed on AFS ACLs.
Principles there should just come along with
alum.mit.edu email accounts.