Downgrade Resilience in Key Exchange Protocols