I think it would be a good idea to add a test where the message contains a leading `\x00` byte. It seems to be a common mistake when implementing OAEP to be too greedy with trimming and therefore the unpadding will fail.

This implementation doesn't seem to have this problem, but it might be a good idea to add it anyway if someone introduces the problem in the future. :)