tests/krb5: Require ticket checksums if decryption key is available