KEYS: Add a new keyctl op to reject a key with a specified error code