Katz/Lindell propose the following modification to the basic CBC-MAC scheme to handle variable length messages (p.125):
We sample two uniform independent keys $k_1, k_2\in \{0,1\}^n$. Then to authenticate a message $m$, we first compute the basic CBC-MAC of $m$ using $k_1$ and call the resulting tag $t$. Then we let the output tag be $t' = F_{k_2}(t)$.
My question is why do we need to use two keys? That is, why is the scheme insecure if we compute the output tag $t'$ using $F_{k_1}$?