Thanks for the example! It has helped me understand better the use case of AEAD for at-rest-encrypted-data.

I finally updated the example to a new one, though it's still message-based (it fits the rest of the article better). If I had come across your example earlier, I might have stayed away from a message-based formulation of the problem at all... Better luck next time I guess :)