NAC

An observation: In Decryptor::doDecrypt, if the content does not have an initial vector, it throws an exception:
https://github.com/named-data/name-based-access-control/blob/ff3ee9f2af0303028b6f5a840f1e5641b3982ac1/src/decryptor.cpp#L254
But this would prevent Decryptor::decryptCkAndProcessPendingDecrypts from trying to decrypt all the pendingDecrypts:
https://github.com/named-data/name-based-access-control/blob/ff3ee9f2af0303028b6f5a840f1e5641b3982ac1/src/decryptor.cpp#L242

Maybe doDecrypt should instead use onFailure to report the missing IV and return? (onFailure is passed to doDecrypt but isn't used.) Or perhaps you want decryptCkAndProcessPendingDecrypts to fail if decryption fails for any of the pendingDecrypts, in which case maybe it (or code that calls it) should catch the exception and report it with onFailure?