move krb5_generate_subkey here and deprecate