- updated lockbox so validation occurs on decrypted data