fromEncryptionDescriptor

Create a decryption stream from authenticated metadata and the file nonce.

Returned plaintext remains untrusted until finish succeeds.