tls: implement Encrypt-then-MAC extension