Change the validation to be able to handle "needs exactly one key out of the following set"

This is pertinent to Z14/Implementation, where there should be one and exactly one of Z14K1, Z14K2, Z14K3.

(This can be eventually also dropped as it may be handled not-declaratively but through explicit functions)