Thanks!
For closure, here's what we determined
The /etc/krb5.keytab got deleted due to a mistake in our centrify migration process. i.e. Human error on our part. We ran a script that cleared out the old domain integration (was using sssd + freeipa) and as part of that script, krb5.keytab gets deleted. But that box was already configured for centrify + AD, so deleting the keytab broke its attachment to the domain.
This answered both the "where'd keytab go?" and "why'd this box drop from the domain?" questions.
And I think based on your answer about the "tatoo" error, that I can ignore that.
Thanks again!