Explicit authenticated encryption?

Hello again!

Perhaps this is a largely subjective assessment caused by inexperience/ignorance, but I did not immediately understand that the cookie encryption option also implies their authentication.

Perhaps the wording signing/encryption confused me (either one or the other, but not together, which means unauthenticated encryption). Later, I learned that the term "signing" is not used in the context of AE.

Of course, I am not an expert in cryptography.. Perhaps there was a place for the assumption that encryption without authentication does not make sense, is insecure (and it is), therefore, there were no additional "identification marks" in the quickstart-documentation, github pages, crates.io about the using of AEAD, ha-ha.

Viewing the source code with comments, of course, clarified everything. Although a quick look at the use of CryptoAlgorithm enum variants in the client code: Encryption (AE or not AE..), Signing -- caused the same misunderstanding.

I think this is a good lesson for me about the importance of understanding the tools you are using and the exploring source code that is required to do so (sometimes more, sometimes less).

Thanks!

Review the quickstart documentation and public GitHub or crates.io descriptions first, then inspect the CryptoAlgorithm enum variants and their client-code usage mentioned in the issue. Clarify that the encryption option provides authenticated encryption and make the terminology consistent wherever the misunderstanding appears.