Limitations on a device-independent key secure against a nonsignaling adversary via squashed nonlocality