keyrings MUST fail if they refuse to take action

[mattsb42-aws]

Following up from awslabs/aws-encryption-sdk-specification#224, all keyrings MUST fail if they are unable or unwilling to write or satisfy decryption contracts.

[lavaleri]

We are pursuing another mechanism to ensure that the implementation meets the specification.