crypto: figure out AKEM API

[elagergren-spideroak]

One option is to split Kem into an unauthenticated Kem and a separate authenticated AuthKem.

But that might not play well with Hpke. It uses an enum for auth modes, and I don't really want to rewrite that as one method per auth mode. Plus, we'll probably run into specialization issues.

Maybe we just make Kem's authenticated methods return a sentinel "unsupported" error (not the panicking macro!) by default?

Failing at runtime is lame, though.

/cc @jdygert