s3-gse: Allow kerberos key type OID to be optional