NAC

To reproduce: In tests/unit-tests/consumer.t.cpp modify the Consume tests to reply with cKeyData before contentData, as shown in my fork:
https://github.com/jefft0/ndn-group-encrypt/commit/f9d4b4a7c14d2a454d989aada05639b6d1d6bb1a

                         if (i.matchesData(*cKeyData)) {
                           cKeyCount = 1;
                           face1->put(*cKeyData);
                           return;
                         }
                         if (i.matchesData(*contentData)) {
                           contentCount = 1;
                           face1->put(*contentData);
                           return;
                         }

Compile with ./waf configure --with-tests and run build/unit-tests. I get the following output:

../tests/unit-tests/consumer.t.cpp:288: error: in "TestConsumer/Consume": check contentCount == 1 has failed [0 != 1]
../tests/unit-tests/consumer.t.cpp:290: error: in "TestConsumer/Consume": check dKeyCount == 1 has failed [0 != 1]
../tests/unit-tests/consumer.t.cpp:291: error: in "TestConsumer/Consume": check finalCount == 1 has failed [0 != 1]

Analysis: The name of the content to consume is /Prefix/SAMPLE/Content . This matches the name of both the contentData and cKeyData which are /Prefix/SAMPLE/Content/FOR/Prefix/SAMPLE/Content/C-KEY/1 and /Prefix/SAMPLE/Content/C-KEY/1/FOR/Prefix/READ/D-KEY/1/2, respectively. The Consumer code seems to expect the network to reply first with the contentData, but this is not guaranteed. It could reply with the cKeyData (which happened in some of my tests). So, I modified consumer.t.cpp to show this case.

Possible solution: Modify the onData callback in Consumer::consume to check whether it got a C-KEY and to try to get the Content packet instead.