Worth noting it is possible to embed decryption keys inside .pcapng files, using editcap --inject-secrets.