Function unwrap_dek 

pub fn unwrap_dek(
    recipient_secret: &[u8; 32],
    wrapped: &[u8],
) -> Result<DataKey, String>

Unwrap a DEK with the recipient’s secret key. Fails for the wrong recipient or a tampered blob.