How about a ciphertext that could be decrypted with two keys, each yielding a different readable plaintext?