Function decrypt_cose 

pub(crate) fn decrypt_cose(
    cose_encrypt: &CoseEncrypt,
    policy: CoseAlgorithmPolicy,
    cek: &[u8],
) -> Result<Vec<u8>, CryptoError>

Authenticates and decrypts a multi-recipient COSE [CoseEncrypt] message.

policy controls whether the protected algorithm is required, must exactly match a typed CEK, or may fall back only for a legacy message. Returns an error for a missing, unsupported, or policy-mismatched algorithm, an invalid CEK length, or failed authentication.