to allow matching keyId to keys even though they are not the best choice if expiredAt is the only criteria.

Example:

key1: { _id: 1, expiredAt: 10 }
key2: { _id: 2, expiredAt: 12 }
request: { _id: 2, time: 8 }

In the example above, getKeyForValidation will choose key1 since it has the closest expiredAt for the given time and since the keyId does not match, it will return an error. This scenario should not happen unless key2 was created before key1, which might be possible with SERVER-28883.