More exception types
Currently Covert raises ValueError for any "normal" errors that might occur because of invalid data or authentication failure, etc, and Exception for errors that signal incorrect use (i.e. buggy application code). The former is catched in CLI main, printing a single-line error message, while the latter prints a traceback.
A more fine-grained selection of exception types should be implemented in covert/exceptions.py such that different types of errors can be handled separately in expect statements. There should be at least AuthNeeded to signify that the credentials provided could not open the file, and probably separate types for data corruption (invalid Poly1305 tag) and signature verification failure. Possibly also a Covert-specific base exception that all other exceptions derive of.
This needs design and implementation, and then going through the process of replacing all current exceptions with the more appropriate types. This would be a good task to for an intermediate developer wishing to become familiar with Covert codebase. An open question is whether Covert should try to catch any standard exceptions that might occur in its code as well as libsodium's nacl.CryptoError, replacing them with its own exception types and providing additional context.