wireguard: add flag to check hmac for decryption