This could also be useful to mitigate a "kerberoasting"-style attack against user passwords. The typical presentation of the attack is against AD services which use a bad password to generate their service keys. That exact attack isn't much of an issue in IPA, since it doesn't lend itself to the same poor method of generating service keys.

However, the same basic approach could be used to get service tickets for user principals (eg, 'kinit -S alice@EXAMPLE.COM') and use the resulting service ticket as a target for password cracking. Key derivation should make this relatively expensive as password cracking goes, but not prohibitive for a moderately well-funded adversary.

To mitigate the attack, it would be nice if FreeIPA exposed enough KDC policy to be able to say something like "no service tickets can be issued for service principals without an instance". Since I can imagine scenarios where such a ticket might be legitimate, finer control might be nice as well.