I have an AAC file that was produced by encrypting an audio MP4 file using Shaka Packager with a known command, including the key and all parameters, like so

Code:
packager in=sample-in.mp4,stream=audio,output=sample-out.aac --segment_duration 60 --enable_raw_key_encryption --keys label=AUDIO:key_id=e08866791b25a47c3cceec4c518990ce:key=e08866791b25a47c3cceec4c518990ce:iv=e08866791b25a47c3cceec4c518990ce --protection_systems FairPlay --protection_scheme cbcs --clear_lead 0
I'm trying to decrypt it back to the original file, but having no luck.

Code:
packager in=sample-out.aac,stream=audio,output=sample_decrypted.mp4 --enable_raw_key_decryption --keys label=AUDIO:key_id=e08866791b25a47c3cceec4c518990ce:key=e08866791b25a47c3cceec4c518990ce:iv=e08866791b25a47c3cceec4c518990ce
errors out with
Failed to detect the container type.
I also tried ffmpeg and mp4decrypt from bento4, with no success.

However, encrypting to .mp4 instead of .aac works, I can decrypt the file with no issues. Any suggestions on how to approach this? I'm using the latest version of shaka from https://github.com/shaka-project/shaka-packager and I'm reproducing the problem with a known good sample .mp4 file. My understanding of audio codecs and containers is also tenuous, so if you go into that territory then ELI5.