I had a look at the HMAC RFC and apparently empty bytes sequence can be used as secret key.

"The definition of HMAC requires a cryptographic hash function, which
we denote by H, and a secret key K. 

...

The authentication key K can be of any length up to B, the
block length of the hash function."
   
https://tools.ietf.org/html/rfc2104.html#section-2

Assuming that is the case, the fix would be to change the Listener to:

```
        if self._authkey is not None:
            deliver_challenge(c, self._authkey)
            answer_challenge(c, self._authkey)
        return c
```


I created a PR for that, if anyone can review it, I appreciate it.
https://github.com/python/cpython/pull/25845