find correct keystone-server 

 (also in the HA case, when only the founder has [:pki][:content] values)

https://bugzilla.novell.com/show_bug.cgi?id=891559
Am I understanding right that the additional check is only needed when the token format is not PKI? If yes, can you add a comment? If no, in which other cases?