When we added the get-keys privilege we lost the ability to setup keytabs with the kadmin ext command. The fix is to note that we got bogus key data and randkey (as we used to).