Factor the actual message encoding/decoding and encrypting/decrypting out to
separate functions from the top-level functions which do the base64-wrangling.

This is particularly helpful in the 'outbound' code-path where the offsets
required to allow room to base64-encode make the flow hard to see when it's all inline.