Check that the kdf_salt and decryption_keys are valid earlier

[remyroy]

This is part of the last comments from the recent ToB audit in improving usability.

A couple of small sad-path performance/usability improvements to consider:

• Check that the kdf_salt and decryption_keys are valid earlier in the decrypt function (ie that len == 32) so we can fail before doing any KDF stuff.