moved CHILD_SA key derivation to keymat_t