just show the key, let the user handle that, i dont see anywhere in the rfc that says u should be hiding it if the ircd gives *