Function decrypt_payload 

pub fn decrypt_payload(
    kem_secret_key: &[u8],
    dsa_public_key: &[u8],
    encrypted: &[u8],
) -> Result<Payload, CryptoError>

Decrypt a payload using the full hybrid cryptosystem pipeline.

Reverses encrypt_payload: verify signature → KEM decapsulation → derive AES-256-GCM key → decrypt payload.

Errors

Returns CryptoError variants for any cryptographic operation failure, including signature verification failure.