Function decide_bind 

pub fn decide_bind(addr: &SocketAddr, key: Option<B3Hash>) -> BindVerdict

Decides whether the listener may bind addr, and which face it then presents.

Pure. Refuses exactly when no key is given, on either face, before the socket exists - so there is no window in which the port is open and unauthenticated - and the key the face demands comes back inside the verdict, so there is no second way to learn it.