When listing an entry by specifying -alias in a keystore, keytool assumes it is a certificate (at link as below), but it could be a secret key entry.
https://github.com/openjdk/jdk/blame/master/src/java.base/share/classes/sun/security/tools/keytool/Main.java#L1294