Put all the heavy work into initialising KEK.

CEK generation now only needs to know which KEK it's being built from.
This reduces the possiblity that an error will occur.
Updating documentation so that it reflects reality now.