`ModeWithAAD` doesn't actually sound right.  Maybe `ModeWithAuthenticationTag` at which point it might make sense to replace `tag` with `authentication_tag` everwhere?

This seems more consistent with the other `ModeWith*` interfaces.