A collaboration engineer enables mixed-mode on a CUCM cluster using the Tokenless CTL method (utils ctl set-cluster mixed-mode). After the cluster restarts, secure phones fail to register and report 'Trust List Update Failed' when downloading their configuration. Manual inspection shows phones still hold an older CTL file signed by physical USB security tokens from a previous deployment. What is the root cause of the registration failure?