Sending a PSK like:
AT%CMNG=0,42,3,"1r0nm@n"
should result in failure, as that is not a valid hex string (as documented in nRF91 AT Commands). Currently this results in "OK", so user thinks that PSK was written correctly. This is not true and connection attempt fails when nrf_connect() is called. This seems totally unrelated to PSK being incorrectly configured, as error should be notified when passing wrong value, not during connection. Unfortunately looking at IP traffic (e.g. from Wireshark) it seems that modem starts (D)TLS negotiation, but silently gives up before exchanging any credentials.