encrypted_record = DTLS13-HMAC-Protected = DTLSInnerPlaintext ||
   HMAC(write_key, nonce || additional_data || DTLSInnerPlaintext)