fail_verify_is_ok
if (fail_verify_is_ok (context, options))
if (ret == KRB5_KT_NOTFOUND && fail_verify_is_ok (context, options))