If the key type does not match any CMS recipient type return
an error instead of using a random key (MMA mitigation). This
does not leak any useful information to an attacker.
PR#3348
(cherry picked from commit bd43b4cf778a53ffa5d77510ecd408a009dc00d2)