server/keyset.c: Return more informative error codes from ks_decrypt.