Function decrypt_file 

pub fn decrypt_file(
    input: &Path,
    output: &Path,
    keys: &EncryptionKeys,
) -> Result<(), CodecError>

Verifies the digest and tag before moving the plaintext to output.