nsupdate: disallow key specification multiple times

norefs