Hash blocks and check against their IDs

While the MAC provided by secretbox guarantees both integrity and
confidentiality under the content hash-derived key, holders of this key (i.e.
anyone who can decrypt the block) can also produce ciphertexts under that same
key. To ensure we've received the correct ciphertext, we need to compute its
hash and ensure it matches the block ID.