Symptom: an operation fails at the decryption stage.
This is the deepest failure in the chain, which makes it the most informative if you read it carefully. The error names the layer that could not be satisfied, and that layer points at the specific mismatch.
Likely causes
- Revision mismatch. The keyset does not carry the generation the content requires — see unsupported revision.
- Missing category. A structurally valid keyset that lacks an entry the operation needs.
- Wrong key kind. Production keys used where per-content material is required, or the reverse — see prod.keys vs title.keys.
- A damaged entry. An edit that changed a value without changing its form.
How to confirm
Read the error for the layer it names. A failure at header handling, key unwrapping and content decryption each point at different parts of the chain. Then compare the revision your keyset carries against the revision the content expects, using the compatibility hub to structure the comparison.
What not to do
Do not replace the keyset first. A decryption error is the most specific signal this workflow produces, and discarding it before interpreting it is how a simple revision mismatch turns into an afternoon of swapping files.
Where this connects
The relationship chain is explained in the compatibility hub, the mechanism in the firmware guide, and the category structure in key categories. If the error is about a single entry rather than the operation, start with invalid key.