So this is perhaps a cover-your-ass desire. I'd like to have a generic error to cover for the tag verification case in GCM. When a GCM tag verification error occurs the retval from CipherFinal_ex is 0, but ERR_get_error() also returns 0. We could assume that this case is ALWAYS a tag verification failure and raise TagError, but what if that's not true?

We could also punt on this issue, land this patch, then take it up as a separate discussion item in the GCM PR. I'm fine with that (in fact, that makes more sense to me than trying to support a use case we haven't landed yet)

I'm :+1: on this for now then. For coverage we can just nocover it since we'll be revisiting it shortly?