Store the profile as an attribute of krb.Key

We don't have type confusion there anymore.
Add a function to determine the amount of padding

It is guaranteed that, for all L, all messages with length
L + paddingBytes(L) will round-trip correctly without crypto residue.
Compute the EC field of a GSS wrap token right
And implement unwrap in the UNSEAL case

Or something resembling it. Tested against remctl.