Uh-oh, looks like the only way out is to unenroll security key completely (if it was enrolled when DNS rebrand was not done).