find correct keystone-server (also in the HA case, when only the founder has
[:pki][:content] values)
the search above might return empty list
token_format must be PKI, that is another result of the search above
Merge pull request #86 from jsuchome/keystone_fixes

find correct keystone-server