FastFirstHopPK 0 prevents tunneled directory connections from working.
See Erwin Lam's email from 3 August 2008 on or-talk: http://archives.seul.org/or/talk/Aug-2008/msg00010.html
It seems that in some cases we build a one-hop circuit to a server without putting its onion key in the extend_info. This happens at least when we don't know any onion key for the server, because we are connecting to it for directory information and we don't have any descriptors yet.
You can test this yourself: run with -FastFirstHopPK 0, with a new empty datadirectory (to avoid cached data), and with no other options set.
The right fix is probably to override should_use_create_fast_for_router so that it uses a create_fast cell for one-hop tunnels when no onion key is known, even if FastFirstHopPK 0 is set.
[Automatically added by flyspray2trac: Operating System: All]