Require exact EdDSA key lengths

Require exact EdDSA key lengths

A key blob longer than the fixed key size was accepted: the key was
imported from the expected-length prefix and the trailing bytes were
silently ignored.  For a DNSKEY this means two different RDATAs (with
two different key tags) could yield the same key, because nothing after
the import ever looks at the leftover bytes.  Treat any length mismatch
as an invalid key instead.