The following command returns an error:

$ keytool -alias foo -dname "CN=Foo" -genkeypair -keystore ./keystore -ext ku:c=dig,kE -storepass changeit
keytool error: java.lang.Exception: command kE is ambiguous:
     keyEncipherment keyAgreement keyCertSign

But kE is not ambiguous. The keytool man page also gives 'kE" as an example in the "Generating Certificates for an SSL Server" section:

keytool -storepass password -keystore server.jks -certreq -alias server |
    keytool -storepass password -keystore ca.jks -gencert -alias ca
    -ext ku:c=dig,kE -rfc > server.pem