Better check for content
Better error message for not ok response code
Better checking for pin
Check that response can be decrypted with the given private key
Don't try to decrypt embedded key unless encrypted content is actually present