What is the basic idea "central authentication, decentral verification" in Kerberos, and why is it valuable?

The KDC authenticates the user once, centrally; afterwards each service verifies the user's ticket on its own with its own secret key, without contacting the KDC, so the services never see the password and the KDC is not involved in every access.

The trick is that the KDC shares a long-term secret with every principal, including every service. When it issues a service ticket, it encrypts the ticket with that service's key. The service can therefore check by itself:

• "This ticket decrypts with my key, so the KDC made it" (authenticity).
• "It names user juser and is still valid" (identity and lifetime).
• "The client's authenticator decrypts with the session key from inside the ticket" (the presenter is the legitimate holder).

What this buys:

• Passwords stay central: only the KDC knows the users' keys. A compromised file server leaks its own key, not the users' passwords.
• Scalability: services verify locally, so access does not add load on the KDC.
• SSO: the user is authenticated once and proves it to many services with tickets.

Go deeper:

• RFC 4120, Section 1.1: The Kerberos protocol — the basic model: a ticket encrypted in the server's key carries the client's identity and the session key.