Currently I'm not calculating the hash for the decrypted data and comparing it to the mac/lastmodified:

https://github.com/humphd/sops-age/blob/main/src/decrypt.ts#L112-L125

This should get added. I've tried doing it, but I'm unclear on the order of the keys, so my hash never comes out the same as sops'.