take identity of local RI from private keys
use remote router indentity
don't specify RI for inbound NTCP connections