Following up from https://github.com/awslabs/aws-encryption-sdk-specification/pull/224, all keyrings MUST fail if they are unable or unwilling to write or satisfy decryption contracts.