Function decrypt_file 

pub fn decrypt_file(
    src: &Path,
    dst: &Path,
    key_hex: &str,
    nonce_hex: &str,
) -> Result<StreamedFile, String>

Decrypt src (ciphertext || tag) into dst, hashing both sides on the way. dst holds unauthenticated plaintext until this returns: on any error it is removed, and a tag mismatch is reported as a decryption failure.