Fernet key repository is empty.

After configuring keystone to use the Fernet token provider, you should use keystone-manage fernet_setup to initially populate your key repository with keys, and periodically rotate your keys with keystone-manage fernet_rotate.[source]

Fernet key repository is not setup correctly.

The Fernet key repository is expected to be readable by the user running keystone, but not world-readable, because it contains security-sensitive secrets.