The roadwarriors carol and dave set up a connection to gateway moon. At the outset the gateway authenticates itself to the clients by sending an IKEv2 RSA signature accompanied by a certificate. The roadwarrios then use the Extensible Authentication Protocol in association with an MD5 challenge and response protocol (EAP-MD5) to authenticate against the gateway moon and includes a Postquantum Preshared Key (PPK) that's also mixed into the derived key material. The PPK_ID used by dave is unknown to moon but since both peers don't enforce the use of a PPK they fall back to regular authentication by use of the authentication data provided in the NO_PPK_AUTH notify.