Balloon-BLAKE2b+HKDF KEM.

include [schemas/kem-balloon-blake2b-hkdf.tcl]

Balloon memory-hardened password hasher must be used with BLAKE2b hash.
=> https://crypto.stanford.edu/balloon/ Balloon

    H = BLAKE2b
    KEK = HKDF-Expand(H,
        prk=balloon(H, passphrase, /kem/salt, s, t, p),
        info="cm/encrypted/balloon-blake2b-hkdf" || /id)

"/kem/*/cek" is wrapped with [cm/keywrap/xchapoly] mechanism.

=> https://datatracker.ietf.org/doc/html/rfc5869.html RFC 5869, HKDF
=> https://www.blake2.net/ BLAKE2b is hashing algorithm
=> https://datatracker.ietf.org/doc/html/rfc7693.html, RFC 7693, same