/var/lib/krb5kdc/ is in krb5-kdc 1.10+dfsg~beta1-2.
This file is owned by root:root, with mode 0o700.