only need to verify main key against expiredKeys

also better error message