how would this work in practice? if the contract is to guarantee decryption, wouldn't the key(s) also need to be on chain? how do you keep the secret?