-u: like -m, but decrypt to verify MAC, see if it's valid then decrypt to dst.