server: REGACK now decapsulates payload, decrypts diffie-hellman key, performs hmac, signature, timestamp clockskew validations, generates shared secret, derives strong key from secret & nonce, hashes results and sends as finishing validation that registration procedure worked correctly