Currently config server nodes use a KeysCollectionClientSharded to generate and find keys used for signing clusterTime. This class is also used by shards and mongos and involves making network calls to read the keys from the config server. Since each config server replicates the admin.system.keys collection, they can use the KeysCollectionClientDirect (introduced in SERVER-30977) to read the keys locally instead, like standalone replica sets do.