IKEv2 responder fetch initiator key role over with two connections.

east, the responder, does not initiator's public key locally.
When AUTH exchange message arrives with IDi=road.testing.libreswan.or
east fetch ipseckey RR for IDi and add it to pluto's global keystore.
And continue with authentication.

Road publish two IPSECKEYs in DNS.
Road bring up first connection. It should establish and ping.

Road restart and add the second connection with new key.
Bring up second connection since east has both keys from DNS it will establish.

Road, the initiator, has east's publickey locally configured.
Note final.sh has ipsec auto --listpubkeys and east has road's key.
