Revised decryption APIs to clarify CredentialResolver/KeyResolver difference.