Prove server MAC key to verifier

[sinui0]

After the TLS connection, it may be desirable for the Prover to prove the server MAC key to the Verifier instead of performing 2PC-GHASH to verify tags. This would allow the Verifier to locally check them without interaction. If decryption of all server messages is deferred we could avoid using 2PC-GHASH entirely.