Function unwrap_kms_response 

pub fn unwrap_kms_response(
    token: &str,
    key: &JweKey,
) -> Result<Vec<u8>, WebexError>

Unwrap a KMS response — may be JWE (encrypted, 5 parts) or JWS (signed, 3 parts). For JWS, the payload is extracted directly (arrives over authenticated Mercury channel).