Last rolekey must be the same as the one trying not to re-assign