For a long time, I've had trouble understanding how group nesting is supposed to work in a multi-forest AD environment. It seems like there are arbitrary limitations placed on group types, with regards to what groups they can contain. For instance, http://msmvps.com/blogs/acefekay/archive/2012/01/06/using-group-nesting-strategy-ad-best-practices-for-group-strategy.aspx speaks about some of these complexities.
Does anyone know why these limitations exist?