auth: GetLatestKey should allow NULL return values