Delete and timeout

The idea behind raising an error is that the information being handled is sensitive information, and if it's me and I wanted to delete that sensitive information and there was a failure I would really like to know about it whether it be because a system error or because there's a typo in the key.

As for the return value, it's along the same lines.  This is sensitive information and retrieving the data from secure memory to insecure memory unnecessarily and then passing it around when in the vast majority of the cases it would not actually be used just seems wrong to me.  I did consider just returning an empty string on success instead of nothing, but I wasn't sure if that would be any more useful.