instead, if obtaining key by keytag is necessary, we walk through all the matching keys and choose the appropriate one