s4:kdc: add aes key support for trusted domains