kerberos: make sure first KEYRING credential is automatically selected

Right now, we ensure the first DIR type signed in kerberos identity
gets selected automatically.  We should do the same for KEYRING types
as well.

To better future proof the code, assume future keyring types will
support multiple identities going forward.

https://bugzilla.gnome.org/show_bug.cgi?id=710116