Once we use plugin-provided prf+() these won't work otherwise.
Instead of creating two IKE_SAs with different identities, this scenario uses simple labels to select the correct child config.