RF: rotate + decrypt minor API changes
TESTS: 88% coverage (mac), minor BFs