Also, the kadmin client could delete old keys from keytabs automatically, specifically removing keys whose kvnos are not listed as valid by kadmind.