RDP to a Windows VM over IAP: serial port 4, NLA and a certificate nobody checks

Google says to verify the RDP thumbprint from serial port 1. On a real VM it was gone. How the password reaches you, what CredSSP protects, and the errors in between.