First, this is not an issue specific to keystone: all OpenStack services will have this, because all OpenStack services are interacting both on the public network (with end users) and the internal network (between each others). Which is why I think this needs to be solved first.

As to how to make this work: I've not thought about it, but I would guess there would be new public and private DNS names attached to the load balancer public and admin IPs, and these should be part of the certificates installed on each node (not in common name, but in alternate names). Maybe it's as simple as this; or maybe it's more complex and it would require more work.