Disallow changing ECDSA key. Which means disallow downgrading before 1449, since it'd be recreated.
Remove support for negType 7. Remove DiffieHellman support: connection setup always uses ECDH now.