Now that we always enforce password quality policies, ktutil get fails because it uses "x" as a password when creating a principal. Of course, it's probably a misfeature that ktutil get creates principals when they don't exist...