pub fn is_spnego(blob: &[u8]) -> bool
True when the blob looks like DER/SPNEGO (starts with ASN.1 tags) rather than a raw NTLMSSP message.