fixup kex-sigalg - we need fallback, so force only TLS, not a specific version