Cross-key validation callback. Empty string = OK; a non-empty string is appended to the collected errors.