On the Key Exposure Problem in Chameleon Hashes