encrypted_record = TLS13-HMAC-Protected = TLSInnerPlaintext ||
   HMAC(write_key, nonce || additional_data || TLSInnerPlaintext)