TAP Hybrid Encryption case 1 is used when the payload is equal to the maximum length

The spec says:

-      1. If M is less than PK_ENC_LEN-PK_PAD_LEN, pad and encrypt M with PK.
+      1. If M is less than or equal to PK_ENC_LEN-PK_PAD_LEN, pad and encrypt M with PK.

https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt#n117

(We'll need to fix the line wrapping here as well.)

But the code does:

  if (!force && fromlen+overhead <= pkeylen) {

https://gitweb.torproject.org/tor.git/tree/src/common/crypto.c#n1262