verifyChecksum
Check a decrypted content key against the checksum the header advertises for kid.
This is what confirms the key the license handed back is the key this content was encrypted with; a mismatch means the right key id came back with the wrong key.
Throws
if the header names no such key id, carries no checksum for it, or declares an algorithm with no defined checksum