keytool (or, precisely, sun.security.util.Password.readPassword) decodes a password entered at a prompt in a very strange style, thus results in a char array which is different from what the user intends to enter (in the case of a non-ASCII password). So --

   $keytool -genkey ... -storepass non-ascii-password
   OK
   $keytool -list
   Enter password: non-ascii-password
   Sorry, cannot be loaded, bad password.

This is quite embarrassing.