This should allow master key rollover. (but the real reason is to allow multiple krbtgt accounts, as used by Active Directory to implement RODC support) Signed-off-by: Love Hornquist Astrand <lha@h5l.org>