Kerberos is an authentication protocol, not a system for wire-encrypting data. You set the quality of protection on SASL to privacy to enable wire encryption (which requires Kerberos to be enabled): https://hbase.apache.org/book.html#_client_side_configuration_for_secure_operation
JMX metrics that HBase exports include replication latency. Additionally, the HBase shell "status, 'replication'" command.
A "Master Master" replication scenario is not unique from a "Master Slave" replication scenario. Follow the standard procedures to configure one cluster to replicate to another, and then vice versa: https://hbase.apache.org/book.html#_cluster_replication