KEYS: fix "ca_keys=" partial key matching