Clarify CMS_decrypt behaviour.