Retrieve service keytab with host keytab authentication?

[Peter Tselios]

Hello, 
When I retrieve a service keytab, what I do is more or less this: 

ipa-getkeytab -a admin -P password  -s service/client.example.com -k /path/to/keytab

However, the ipa-getkeytab man page mention this: 
===========
 -Y, --mech
SASL mechanism to use if -D and -w are not specified. Use either GSSAPI or EXTERNAL.
===========

So, if I am not mistaken, that means I can use another keytab in order to download the
service/client.example.com one. Is that true? 
And if so, which keytab should I use and how? Because I cannot find an option that goes
along with the -Y GSSAPI. 

Thanks