The re-registration fast-path skipped validation for a matching node key without checking expiry, so an expired node could re-auth with a spent key. Gate it on the node not being expired. Updates #3312