docs: def spec_compliant_decrypt(jwe, jwk, validate_claims=True,
                             expiry_seconds=None):
      """ Decrypts a deserialized :class:`~jose.JWE`
  
      :param jwe: An instance of :class:`~jose.JWE`
      :param jwk: A `dict` representing the JWK required to decrypt the content
                  of the :class:`~jose.JWE`.
      :param validate_claims: A `bool` indicating whether or not the `exp`, `iat`
                              and `nbf` claims should be validated. Defaults to
                              `True`.
      :param expiry_seconds: An `int` containing the JWT expiry in seconds, used
                             when evaluating the `iat` claim. Defaults to `None`,
                             which disables `iat` claim validation.
      :rtype: :class:`~jose.JWT`
      :raises: :class:`~jose.Expired` if the JWT has expired
      :raises: :class:`~jose.NotYetValid` if the JWT is not yet valid
      :raises: :class:`~jose.Error` if there is an error decrypting the JWE
      """
      protected_header, encrypted_key, iv, ciphertext, authentication_tag = map(
          b64decode_url, jwe
      )
      header = json_decode(protected_header)
      if not _verify_header(header):
          raise Error('Header is invalid')
  
      alg = header[HEADER_ALG]
      enc = header[HEADER_ENC]
  
      # decrypt cek
      encryption_key = _decrypt_key(encrypted_key, jwk, alg)
      mac_key, enc_key = _parse_encryption_keys(encryption_key, enc)
  
      # verify authentication tag
      expected_tag = _generate_authentication_tag(
          mac_key, json_encode(header), ciphertext, iv, enc
      )
      if not const_compare(expected_tag, authentication_tag):
          raise Error('Mismatched authentication tags')
  
      # decrypt body
      ((_, decipher), _), _ = JWA[enc]
      # http://tools.ietf.org/html/rfc7516#section-5.1 step 11
      M = decipher(ciphertext, enc_key, iv)
  
      if HEADER_ZIP in header:
          try:
              (_, decompress) = COMPRESSION[header[HEADER_ZIP]]
          except KeyError:
              raise Error('Unsupported compression algorithm: {}'.format(
                  header[HEADER_ZIP]))
  
          plaintext = decompress(M)
      else:
          plaintext = M
      claims = json_decode(plaintext)
      _validate(claims, validate_claims, expiry_seconds)
  
      return JWT(header, claims)