test simplest case first for verifyChallenge()
use consistent naming for challengeKeyResponse