I found a better explanation of gMASs and MSAs here:
https://syfuhs.net/how-managed-service-accounts-in-active-directory-work
(I'm still not sure if the KDS key is used to derive the keys for regular MSAs or just gMSAs. And if not, then how key retrieval works for MSAs.)