Geyser and Floodgate are using different keys
Applies to Geyser, Paper, Velocity, BungeeCord.
What it looks like in your log
Failed to decrypt player data
What causes it
The key.pem files differ between the Geyser and Floodgate installs, or auth-type is not set to floodgate, so Bedrock players are rejected.
How to fix it
Copy the exact same key.pem to every Geyser and Floodgate install (binary transfer, not text mode) and set auth-type: floodgate in the Geyser config.
Not sure this is your problem? Paste your log and Roastd will tell you which of these it actually matched, and what else it found.
Check your own log