r21330: move fetching of krb5 keys into its own function