Decrypt S/MIME Email in [High] Sierra mail.app

Running Sierra 10.12.6. I have most things working WRT S/MIME in mail.app (e.g. I can sign and encrypt emails and folks on the other side can decrypt). What I haven't figured out is why I can't decrypt emails sent to me. They show up with "Security: [lock symbol] Encrypted" in the subject line, and no amount of clicking will open/decrypt.

One thing that has been causing problems is that case matters when comparing sender email address to email address in a certificate. To send an encrypted email I fixed that with a "New Certificate Preference..." using the email address as formatted in the sender email with upper and lower case. But no joy on decrypting. Even when I send myself an encrypted email...I cannot decrypt it.

I've also tried with High Sierra...exact same results.

I'm using Omnikey 3021 and ActivClient 4.0.1.92. Token shows up in keychain access.app just fine. I have what I think are the right CA certs trusted.... I can send encrypted and signed email so if it is not right it is really close.