support_desmd5 flag support added to kadmin cli a while ago. des-cbc-md5 has other problems but that's a different bug.