WireGuard: implement responder handshake decryption