pub fn open_payload(
payload: &EncryptedCommonsPayload,
dek: &DataKey,
) -> Result<Vec<u8>, String>Expand description
Open a payload with the DEK — verifies the content-address commitment (the bytes are the committed bytes) then AEAD-decrypts. Any tamper (to ciphertext or a swapped payload) fails.