NTLM Auth is hot garbage and shouldn't be used, but is still possible in HTTP/2 iirc (HTTP Negotiate way), just nobody implements it for a good reason.

Personally I'm not sure why current HTTP2 stacks prevent Negotiate mechanism, but I suspect it's because of connection reuse and Negotiate doing connection-oriented auth - so I suspect Microsoft temporarily banned such feature (I can't find reference to other implementations downgrading, but outside of Microsoft on IIS not many do kerberos over http)