only use tsig keys mutually

roles/knot/templates/etc/knot/knot.conf.j2

@@ -38,7 +38,8 @@ remote:
 {% for remote in ( (zones | map(attribute='replicas') ) + (zones | map(attribute='masters') ) ) | flatten | unique %}
 
   - id: remote-{{ remote }}
-{% if knot_tsig_key is defined %}
+{% if knot_tsig_key is defined and 'knot_tsig_key' in hostvars[remote %}
+{# only use TSIG mutually, i.e. if both parties have a key #}
     key: {{ knot_tsig_key.name }}
 {% endif %}
 {% for address in hostvars[remote].knot_dns_addresses %}