Though gssapi is not Heimdal, it is base Kerberos and it too must
be private. The obvious effect is some ports linking against base
gssapi with either ports/security/krb5 or ports/security/heimdal
installed failing to link.