fixed onsense with non-hardened auth key derivation