If this function is only for decrypting the response to `/account/keys`, it probably shouldn't accept "keyInfo" as an argument: the false-generalization is confusing. I'd put the `kw("account/keys")` call in this function and remove the `keyInfo` argument.

It might even be appropriate to fold `deriveBundleKeys` into this method instead of breaking it out as a separate function.. depends upon whether we have other API calls which HMAC+encrypt their responses this way (I think no).