remember which public keys have been used for authentication and

remember which public keys have been used for authentication and
refuse to accept previously-used keys.

This allows AuthenticationMethods=publickey,publickey to require
that users authenticate using two _different_ pubkeys.

ok markus@