tls-crypto: Move AEAD ownership to the protection layer