I think that part of the guide is not worded well. They are not disabling keystone but rather not starting the legacy keystone service. Instead, keystone now runs under Apache, which is started in the section "Finalize the installation" (systemctl start httpd.service). This in turn starts the keystone code which listens on ports 35357 (admin) and 5000 (public), and is what is being queried when you run "openstack service list".