s4 dns: When we got a TKEY, we need to remember which key to use for signing