shipped with built-in Kerberos support in version 1.1 of the .NET Framework
still has no built-in security even in version 1.1
can be secured by setting an option in machine.config

allows you to layer SSL protection onto the remoting channel
does not secure callbacks or events
causes requests to be processed via the ASP.NET pipeline
all of the above

Integrated Windows Security (Kerberos)
SSL
a custom SSPI remoting sink provided by Microsoft
Even if you've configured IIS to use Kerberos ("Integrated Windows Authentication") to authenticate clients, you'll need to also turn on SSL if you want to add integrity and confidentiality protection to the channel.

is impossible today
requires writing code to request Kerberos tickets from the domain controller
isn't very difficult but also isn't supported by Microsoft at the moment