Check DH pubkey equality before skipping

On AKE success, verify that the DH pubkey for the specified keyid
matches before skipping key replacement.

Reported by @osnr in #47.