It turns out that I totally forgot about trusted domains for direct integration. Currently they do not work the same way as the joined domain, so if I select auto_private_groups for the main domain, I get:

$ getent passwd puser(a)win.trust.test 
puser@win.trust.test:*:10000:10000:puser:/home/puser:/bin/sh 

-- OK, both values are the same here. But:

$ getent passwd childuser(a)child.win.trust.test childuser@child.win.trust.test:*:30000:40000:childuser:/home/childuser@child.win.trust.test:/bin/bash

-- the user private group is not generated here.

I must have thought that subdomains with direct integration always use the private groups, but it's only true for ID mapping... Luckily we haven't released 1.16.1 yet, so I would like to just change the semantics of the auto_private_groups option to also affect trusted domains. If someone wants per-subdomain granularity, I would later prefer to make the option valid for the subdomain sections, but for the most part, I suspect that users will want all or nothing.