[Auth] Is it possible to use both TSIG key and IP address restriction for AXFR zone transfers?

[erisk-id]

I know that

# pdnsutil activate-tsig-key <zone> <keyname> primary 

allows PowerDNS to force a TSIG key during zone transfer.
I also know that

# pdnsutil set-meta <zone> allow-axfr-from <secondary_ip>

can prevent AXFR requests from being accepted from any IP other than the specified one.
When I combined the two I thought I could disallow AXFR requests from non-specified IPs and no TSIG use requests, but this was not the case.
#15348

Am I correct in assuming that there is no such setting in PowerDNS?

[erisk-id]

What I want to do is
Requests from IP addresses out of range → REFUSE
Requests from IP addresses within the range → REFUSE
Requests from out-of-range IP addresses with TSIG key → REFUSE
Requests from IP addresses in range with TSIG key → NOERROR