Fix GSSAPI Key Exchange for older clients (#1323622)
    
    Failed with older clients, because server was doing signature over
    different data than the verifying client. It was caused by bump of
    minimal DH groups offered by server and a bug in code, which was
    using max(client_min, server_min) instead of client_min as proposed
    by RFC4462.