crypto-openssl-gcm: account for failed decrypts