With the CFX support in, almost everything (except telnet, which is still DES-specific) should work in a setup with only AES key types enabled. We should exercise that. (And, someday, deal with telnet.)