The ktrem old option seems to remove all but the most recent key. It would be nice if it had an option to remove all keys that have are neither current nor added within some period of time, so you could rekey and remove keys that will not be used for current tickets.