public static function unseal(
        string $ciphertext,
        EncryptionSecretKey $privateKey,
        $encoding = Halite::ENCODE_BASE64URLSAFE
    ): HiddenString {
        $decoder = Halite::chooseEncoder($encoding, true);
        if ($decoder) {
            // We were given hex data:
            try {
                /** @var string $ciphertext */
                $ciphertext = $decoder($ciphertext);
            } catch (\RangeException $ex) {
                throw new InvalidMessage(
                    'Invalid character encoding'
                );
            }
        }

        // Get a box keypair (needed by crypto_box_seal_open)
        $secret_key = $privateKey->getRawKeyMaterial();
        $public_key = \sodium_crypto_box_publickey_from_secretkey($secret_key);
        $key_pair = \sodium_crypto_box_keypair_from_secretkey_and_publickey(
            $secret_key,
            $public_key
        );
        
        // Wipe these immediately:
        \sodium_memzero($secret_key);
        \sodium_memzero($public_key);
        
        // Now let's open that sealed box
        $message = \sodium_crypto_box_seal_open(
            $ciphertext,
            $key_pair
        );

        // Always memzero after retrieving a value
        \sodium_memzero($key_pair);
        if (!\is_string($message)) {
            // @codeCoverageIgnoreStart
            throw new InvalidKey(
                'Incorrect secret key for this sealed message'
            );
            // @codeCoverageIgnoreEnd
        }

        // We have our encrypted message here
        return new HiddenString($message);
    }