I have proved that UNIX/AD Kerberos authentication works without the presence of a keytab file so I'd like to know whether I should worry about it (given I'll need an individual keytab for each server I want to provide AD authentication services on).
How did you prove this exactly?
If you use net ads join, Samba does in fact create a standard principal for a computer object. It just does not export this to a system keytab file, unless configured explicitly.
Check out the "kerberos method" parameter in smb.conf(5) (for samba 4.0; not sure about the older versions).
If you do not need to expose any other kerberized services, such as sshd or httpd, to machines in the domain, you do not need an explicit keytab. If your goal is to have single sign on, it is necessary to create extra principals and put them in the system keytab.
when you register a system with domain controller (net ads join), this will create a valid host principle for the system in /etc/krb5.keytab. This will create a computer object on AD. This object tracks the principle on the AD side what the data is stored in /etc/krb5.keytab client side.
If you just use NIS for the NSS layer and pam_krb5 in the PAM configs /etc/pam.d/system-auth and /etc/pam.d/password-auth, there will be no need for you to register this system to AD.
How did you setup your UNIX to AD integration? Knowing your setup will help us properly answer your question.
AD is both a Kerberized and LDAP Directory Services environment. Kerberos is used for both authentication, encryption hence why keytabs are normally required.
If you like to get the benefits of Kerberos as part of your UNIX to AD integration without the headaches of manually managing keytabs, consider using Centrify Express http://www.centrify.com/express.