Hrm, it occurs to me we have no way to detect if an encrypted blob has AAD or not. You just have to know from context whether it does or not and pass `userId` appropriately. Seems not great.

On the other hand, what would we do if passed userId and stored userId mismatch? Should we allow you to not pass a userId if there was one set at seal time? And is it OK if you do pass one and there wasn't one set? If these are both OK, we should probably store the fact that userId was passed in the record and relax the contract of seal/open. If not, the current contract is probably OK.

Need to think on this more.