I'd reword this a bit, start with the fact that by `cryptography` always emits a 16-byte tag, and go from there.