code: func (e *Engine) UnboxCredential(ctx context.Context, ct, encMec, mecNonce,
  	cekNonce, ctNonce []byte, privKP *EncryptionKeyPair, pubKey []byte) ([]byte, error) {
  
  	mek, err := e.Unbox(ctx, encMec, mecNonce, privKP, pubKey)
  	if err != nil {
  		return nil, err
  	}
  	defer mek.Destroy()
  
  	cek, err := deriveKey(ctx, mek.Buffer(), cekNonce, 32)
  	if err != nil {
  		return nil, err
  	}
  
  	cekb := [32]byte{}
  	copy(cekb[:], cek)
  
  	ctNonceb := [24]byte{}
  	copy(ctNonceb[:], ctNonce)
  
  	err = ctxutil.ErrIfDone(ctx)
  	if err != nil {
  		return nil, err
  	}
  
  	pt, success := secretbox.Open([]byte{}, ct, &ctNonceb, &cekb)
  	if !success {
  		return nil, errors.New("Failed to decrypt ciphertext")
  	}
  
  	return pt, nil
  }
docs: // UnboxCredential does the inverse of BoxCredential to retrieve the plaintext
  // version of a credential.