Presently, encrypt encodes its result using a MAC, which is good.
However, decrypt never decodes the result, and as such never validates the MAC.
This is an absolute requirement that decryption should not happen unless the MAC is valid (the MAC must be checked prior to decrypting).
