Sign then Encrypt

Just as a heads up this is wacky as shit because of some weird merging and rebasing…I'm still looking at it but if you see anything odd please let me know.
This should be inside a `try-except`. It can fail with `RuntimeError` if the MAC cannot be verified.