Hybrid users sign in to Microsoft Entra joined Windows devices by using Windows Hello for Business and need single sign-on to Active Directory Domain Services resources. The deployment must not require a public key infrastructure (PKI). Which trust type should you use?