Fix multiple-secrets mechanism; improve specs

The multiple-key decryption does not currently work as intended--it only ever actually uses the first key. This fixes that and adds specs to confirm intended behavior.