Ah turns out this binary actually isn't statically linked at all. It's just the UPX packer that you mentioned that adds a trampoline/stub (the decompression routine I suppose) around the actual binary [and that trampoline code is what's completely static]:

    ldd kerf-unpacked
    	    linux-vdso.so.1 =>  (0x00007fff5e7f1000)
	    libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007ff1833aa000)
	    libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007ff1830a4000)
	    libreadline.so.6 => /lib/x86_64-linux-gnu/libreadline.so.6 (0x00007ff182e5d000)
	    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ff182a99000)
	    /lib64/ld-linux-x86-64.so.2 (0x00007ff1835d1000)
	    libtinfo.so.5 => /lib/x86_64-linux-gnu/libtinfo.so.5 (0x00007ff182870000)

So using NSS shouldn't be an issue; and the binary actually does use it

      open("/lib/x86_64-linux-gnu/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = 3