code: func (n NACLSecretbox) Decrypt(record api.MaybeEncryptedRecord) ([]byte, error) {
  	if record.Algorithm != n.Algorithm() {
  		return nil, fmt.Errorf("not a NACL secretbox record")
  	}
  	if len(record.Nonce) != naclSecretboxNonceSize {
  		return nil, fmt.Errorf("invalid nonce size for NACL secretbox: require 24, got %d", len(record.Nonce))
  	}
  
  	var decryptNonce [naclSecretboxNonceSize]byte
  	copy(decryptNonce[:], record.Nonce[:naclSecretboxNonceSize])
  
  	// Open's first argument is an "out", the data that the decrypted message should be
  	// appended to.  Since we don't want to append anything, we pass nil.
  	decrypted, ok := secretbox.Open(nil, record.Data, &decryptNonce, &n.key)
  	if !ok {
  		return nil, fmt.Errorf("no decryption key for record encrypted with %s", n.Algorithm())
  	}
  	return decrypted, nil
  }
docs: // Decrypt decrypts a MaybeEncryptedRecord and returns some bytes