Major improvements

prepare encPMS as soon as the cert is available
use browser aes decryption by default
removing extra communication round