a number of weeks ago, to facilitate migrating many
hundreds of machines to a new network setup, i wrote a
simple and fairly bone-headed ndb database checker,
ndb/vrfy.  it was amazingly effective, if provincial.

it catches all the classics like badly formatted eas,
duplicate eas,  mistyped keys (eg ethr and not ether)

the referenced, but not included, checkndb, checks
to see that the user was "okay" (not expired, in ndb),
but depends on local rules, kenfs and /adm/keystat,
none of which are universal.  /adm/keystat is a local
invention to allow anyone to make a rough check for
expired keys.  if you really want a copy email me privately.

- erik