com.apple.kerberos.kdc is a self-signed key used for Kerberos authentication when you log into another Mac in your local area network, log into Back To My Mac, log into iCloud or MobileMe, or use Apple screen sharing.
It is necessary for automatic negotiation and encryption of the username and password for these functions. It's not signed by a CA because it's not unique to a particular computer, which is why it's "not trusted". If you delete it, you will not be able to automatically log in to any of those services, even if you tell the system to remember your username and password in the Keychain.
I believe, though I'm not sure, that com.apple.systemdefault is used to automatically log you on to the computer if you have automatic login available. It also isn't signed by a CA because it's the generic encryption key that is used to protect your system password. Deleting this certificate could cause problems with logging on to your compute; I recommend leaving it alone.
In addition, regarding your first query check this two blog:
Although run from a system LaunchAgent property list, studentd is run
as the user from login. If you log into a user account which doesn’t
yet have one, it creates a security certificate in that user’s login
keychain, with a name starting with ‘member:’ followed by two UUIDs.
The first of these is that user’s UserIdentifier given in
~/Library/studentd/AdHocConfiguration.plist, thus is that student’s
identifier for the purposes of studentd. That certificate isn’t
trusted, but trust is obtained later if the user connects that Mac to
a Classroom system.
Also, note from Apple:
Apple also confirms that it’s related to studentID and classroom.app.
Also that is won’t be generated in future versions of macOS.
It’s Apple software and doesn’t appear to have any impact on your Mac. I hope that solves the mystery for you and reassures you that it isn’t anything more sinister.