if err != nil {
			return
		}
	} else {
		em, err = decrypt(priv, ciphertext, noCheck)
		if err != nil {
			return
		}
	}

	firstByteIsZero := subtle.ConstantTimeByteEq(em[0], 0)
	secondByteIsTwo := subtle.ConstantTimeByteEq(em[1], 2)

	// The remainder of the plaintext must be a string of non-zero random
	// octets, followed by a 0, followed by the message.