1047. [bug] When a request was refused due to being signed with a TSIG key derived from an unsigned TKEY negotiation, the response could have an rcode of SUCCESS rather than REFUSED. [RT #1886]