Revertsd7dc5e0. The KEY_ID-domain alias-null branch targeted duck-detector's timing-side-channel WARN, but the WARN persisted in subsequent testing and the combined fix attempts pushed the Tamper score from 4 to 14 with a new key-tamper detection on a second detector. Roll back to thea7e7e45baseline to investigate from a clean state.