Fix enctype selection issues for PAC and other authz-data signatures

Cherry pick from commit 8586d9f88efcf60b971466f0d83ea0bc1962e24f - not sure if I applied it correctly. Does it make sense to apply this to 1.5? (It makes cross-realm work for me, but I'm not sure why since all keys have aes256-cts-hmac-sha1-96 enctypes anyway.)