Secret Key-Enabled Authenticated-Capacity Region, Part I: Average Authentication