If it's zero keyed, ctrtool will handle it on it's own. If the output files are garbage, it's not zero keyed. I don't think Citra supports retail encryption. Just zero key encryption. If the demo doesn't work, it's probably not zero keyed and using dev key or retail key.