Perhaps we can generalize `_CipherContext` to not require a specific implementation for `_AEADCipherContext`?  It'd be nice if the `BlockCipher` didn't have to distinguish between these things and only the backend cared.