aes_error_t cryptx_aes_encrypt_and_digest(
	aes_ctx *ctx,
	uint8_t *plaintxt, size_t plaintxt_len,
	uint8_t *aad, size_t aad_len,
	uint8_t *ciphertxt, uint8_t *digest,
	...
);

// if cipher mode NOT GCM, va_arg will be used to retrieve the following, in order:
// hash_algorithm
// hash_key (if NULL, hash only. if present, hmac)
// hash_key_len

// If ciphermode GCM, internal auth tag instead