Decryptor

Walks a freshly-parsed PdfObject tree and decrypts strings + streams in place using a StandardSecurityHandler. The object number / generation of the enclosing indirect object is the per-object key seed.

/Encrypt and /XRef objects are skipped — those are part of the security machinery itself and must not be re-decrypted.