Raised when a peer message cannot be decrypted or processed safely.
The :reason field is the stable machine-readable failure contract:
:truncatedmeans a required public-key field or authentication tag was incomplete.:authentication_failedmeans AEAD verification rejected the ciphertext.:invalid_public_keymeans the peer supplied a public key rejected by the selected DH function.
All reasons use the message "Decryption failed" so backend details and peer
data are not exposed.
If the failure occurs during the handshake phase, the :remote_keys
field contains any remote public keys processed before the failure. Failed
operations leave the session state and cipher nonce unchanged.