kdc: support pkinit_kdc_revoke for pkinit anchors