Originally, the key store was going to be planned to default to "admin.datakeys". This proved impractical because admin elevates lots to X locks and permission issues with admin in some scenarios.

As a result, the keystore should always require a collection.