If a deployed kerberos environment has a single point of failure then its been deployed poorly. Kerberos has replication mechanisms to provide redundancy.

This concentrates on the "what if it fails" worst case scenario of a single point of failure. This doesn't answer the "what if it is subverted" worst case scenario of a single point of failure. (Other posters have noted the requirement to lock down the kerberos server tightly, but seemingly more with a view to keeping the server functioning, rather than keeping its data safe from exposure and corruption. The lock down mechanisms probably do both, but you need to keep both views in mind.) --Sandy