pake-kem

I added a more detailed threat model to the README, to inform any users. This PAKE would work for, eg, a protocol that uses an ephemeral PIN as a password, but that's not true of every use case. A quick explanation of one of the claims. The reason a quantum adversary with an old transcript can learn the password is simply bc they see MAC tags which are generated using the CPace shared secret. This is enough information for a quantum adversary to tell whether their password guess is correct. cc @kevinlewi