I have written a specification for krb5_kt_read_service_key. This routine should serve the purpose you have in mind.