only set error code in case of failure, add comment

lib/krb5/crypto.c

@@ -1880,8 +1880,15 @@ verify_checksum(krb5_context context,
 	    return ret;
     } else
 	dkey = NULL;
+
+    /*
+     * If checksum have a verify function, lets use that instead of
+     * calling ->checksum and then compare result.
+     */
+
     if(ct->verify) {
 	ret = (*ct->verify)(context, dkey, data, len, usage, cksum);
+	if (ret)
 	    krb5_set_error_message(context, ret, 
 				   N_("Decrypt integrity check failed for checksum "
 				      "type %s, key type %s", ""),