Don't allow PKCS#7/CMS encrypt with PSS.