The tsig unit test was only testing if everything went ok, but it was not testing whether the error paths work. Add two more unit tests - one uses the time outside of the TSIG skew, and the second trashes the signature with random data.
3835d75f00