all encryption/message digests are applied to the 'contents', leaving out the 'type' field.
See Implementation
all encryption/message digests are applied to the 'contents', leaving out the 'type' field.