Merge "Require IND-CPA by default for new AndroidKeyStore keys."