When an exception occurs, null is returned. This can result in an NPE when the key is later used, making it difficult to identify the real issue. In fact, one can create a KerberosKey without any failure but its getEncoded() throws an NPE.