Citra, being a free and open-source emulator, cannot legally distribute these encryption keys. The keys are considered proprietary and are protected by copyright laws. As a result, Citra is designed to work these keys if you provide them, but it does not include them out of the box.
Nintendo 3DS games are encrypted using the Advanced Encryption Standard (AES). The 3DS hardware handles decryption using keys burned into its bootrom. Because the Citra emulator does not include these copyrighted keys out of the box due to legal restrictions, users must provide them.
For Citra to reference the text file, it must reside in a specific system folder named sysdata . Depending on your device layout or your specific branch of the emulator (such as Lime3DS or PabloMK7's forks), the file paths differ.