crypto-native: don't expand aes-cbc keys twice