Downsides: * AEAD MACs are not covered by this control and are enabled in all 3 cases * change is not backwards-compatible, policies w/o ssh_etm will have to etm@SSH = DISABLE_NON_ETM (cherry picked from commit 8f49dfad) Related: #40