In krb5-1.6.1/src/kdc/krb5kdc.M there is (just like 1.4.3 where I
noticed the problem):

> .B \-k
> .I keytype
> option specifies the key type of the master key in the database; the default
> is KEYTYPE_DES.

First of all, that's not even the right namespace ("des-cbc-crc" would
be the syntax that actually works...)

Second, it's a lie - I'm pretty sure the default is des3-hmac-sha1...

(Third, the default for master_key_type isn't listed in krb5-1.6.1/src/config-files/kdc.conf.M 
 which would have helped me notice this the first time around, even
 though defaults for things like master_key_name which *never ever
 change* are...)