validate decrypted key
I'm not 100% happy with die on failure.  Maybe instead of taking the
passphrase at the outer most constructor, we take a callback to call
to get the passphrase?  This would allow us to potentially reprompt
when validation fails.