NewOpenReadSeeker is a streaming variant of Open.

Open authenticates and decrypts a box produced by Seal and appends the message to out, which must not overlap box.

Seal appends an encrypted and authenticated copy of message to out, which must not overlap message.

Overhead is the number of bytes of overhead when boxing a message.