code: func NewDecryptStream(versionValidator VersionValidator, r io.Reader, keyring Keyring) (mki *MessageKeyInfo, plaintext io.Reader, err error) {
  	ds := &decryptStream{
  		versionValidator: versionValidator,
  		ring:             keyring,
  		mps:              newMsgpackStream(r),
  	}
  
  	err = ds.readHeader(r)
  	if err != nil {
  		return &ds.mki, nil, err
  	}
  
  	return &ds.mki, newChunkReader(ds), nil
  }
docs: // NewDecryptStream starts a streaming decryption. It synchronously ingests
  // and parses the given Reader's encryption header. It consults the passed
  // keyring for the decryption keys needed to decrypt the message. On failure,
  // it returns a null Reader and an error message. On success, it returns a
  // Reader with the plaintext stream, and a nil error. In either case, it will
  // return a `MessageKeyInfo` which tells about who the sender was, and which of the
  // Receiver's keys was used to decrypt the message.
  //
  // Note that the caller has an opportunity not to ingest the plaintext if he
  // doesn't trust the sender revealed in the MessageKeyInfo.
  //