You don't want or need asetkey. There is a test in cf/kerberos.m4 that's supposed to avoid building it on heimdal but it might not be working or might not have made it in to 1.4.1. Easiest fix is configure --without-krb5.