Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.420 (Entity 5.420)
Subject: kdb5_util update_princ_encryption uses latest mkey instead of 
 active mkey
X-RT-Original-Encoding: iso-8859-1
Content-Length: 252

Another bug which Tom found, and I've investigated a little bit:

  1. kdb5_util add_mkey -s
  2. kdb5_util update_princ_encryption

The second command updates all of the principles to the new key even
though it hasn't been activated with use_mkey yet.