Since we are using PKI tokens now, the keys to validate tokens need to be the same across all keystone instances on all controllers.