don't leak timing info about padding errors by generating a fake key

don't leak timing info about padding errors by generating a fake key
afterwards. openssl has a more complicated fix, but it's less intrusive
for now to simply hoist the expensive part (fake key generation) up without
sweating a branch or two.
ok bcook jsing