Upper Bounds on Key Rates in Device-Independent Quantum Key Distribution Based on Convex-Combination Attacks