> I think we're going to actually want to move away from returning just strings in this way.

I think that is right. Haven't thought about signing so far, but my feeling was that the method interfaces will evolve in this process.

> I'm thinking it might make more sense to do all the decrypting processing on the packetlist of a message and then return that processed message object again.

I think that depends on how we define the `message` class. If `message` class should be a higher abstraction on top of a packetlist, then it doesn't feel right to do the decrypting process of the message in the packetlist.
I'm currently having this model:
- a packet e.g. `packet_symmetrically_encrypted` knows about its internal structure, can read, write, encrypt, decrypt
- a 'packetlist' is a lean concept. It knows that it consists of packets, has some helper methods and can read and write a packetlist
- a 'message' knows that it contains specific packets like `packet_public_key_encrypted_session_key` and has all the logic to decrypt itself

> I ultimately want decrypt and decryptAndVerifySignature to return basically the same type.

Sounds good.