I will take the REALM out of the key name, and rely on users to segregate their principals into separate files (e.g. kdc1.reamlone.local.yaml and kdc2.example.com.yaml).