Was this really even right before? e.g. Shouldn't the size passed to get_encrypted_length be the difference between the TS-aligned start and the TS-aligned end? (which can be larger than res.cleartext_size)