According to the official 3DS Emulation Guide , the only legal way to obtain these keys is to dump them directly from your own Nintendo 3DS hardware:
Nintendo utilizes Advanced Encryption Standard (AES) hardware keys inside the 3DS console. These keys secure the system software and prevent unauthorized dumping of game cartridges. Why Emulators Require Keys citra aes keystxt updated
Without an updated aes_keys.txt file, Citra will display an error message stating that your ROMs are encrypted and cannot be loaded. How to Legally Obtain Up-to-Date 3DS Keys According to the official 3DS Emulation Guide ,