code: func NewSigncryptOpenStream(r io.Reader, keyring SigncryptKeyring, resolver SymmetricKeyResolver) (senderPub SigningPublicKey, plaintext io.Reader, err error) {
  	sos := &signcryptOpenStream{
  		mps:      newMsgpackStream(r),
  		keyring:  keyring,
  		resolver: resolver,
  	}
  
  	err = sos.readHeader()
  	if err != nil {
  		return nil, nil, err
  	}
  
  	return sos.signingPublicKey, newChunkReader(sos), nil
  }
docs: // NewSigncryptOpenStream starts a streaming verification and decryption. It
  // synchronously ingests and parses the given Reader's encryption header. It
  // consults the passed keyring for the decryption keys needed to decrypt the
  // message. On failure, it returns a null Reader and an error message. On
  // success, it returns a Reader with the plaintext stream, and a nil error. In
  // either case, it will return a `MessageKeyInfo` which tells about who the
  // sender was, and which of the Receiver's keys was used to decrypt the
  // message.
  //
  // Note that the caller has an opportunity not to ingest the plaintext if he
  // doesn't trust the sender revealed in the MessageKeyInfo.
  //