Using PicketLink subsystem in EAP/WF with server bound to IPv6 address returns host name from IPv6 URL enclosed in [].
This is unfortunate with regard to [] used in DMR for lists, therefore [] are stripped from trust-domain so key alias in not found in the map of aliases.