protected function _checkKEKSize(string $kek): self
    {
        $len = $this->_keySize();
        if (strlen($kek) != $len) {
            throw new \UnexpectedValueException("KEK size must be $len bytes.");
        }
        return $this;
    }