make KID tag-stripping more robust
make KID tag-stripping more robust

As per the comment, we want to strip off two leading bytes and one
trailing byte from Keybase KIDs. We shouldn't assume the length of the
KID. If the length changes on us, we would rather fail with bad length
errors than mysteriously reject valid signatures.

oconnor663/clinacl,oconnor663/clinacl