gensec: Refuse to seal if we did not negotiate to sign