Receive the build message at a certain hop, decrypt its encrypted record,
read the enclosed tunnel request, decide how to reply, write the reply,
encrypt the reply record, and return a TunnelBuildMessage to forward on to
the next hop.
There is only one of these.
Instantiated by BuildHandler.
Decrypt the record targetting us, encrypting all of the other records with the included
reply key and IV. The original, encrypted record targetting us is removed from the request
message (so that the reply can be placed in that position after going through the decrypted
Note that this layer-decrypts the build records in-place.
Do not call this more than once for a given message.
the current hop's decrypted record or null on failure