code: func (e *Engine) BoxCredential(ctx context.Context, pt, encMec, mecNonce []byte,
  	privKP *EncryptionKeyPair, pubKey []byte) ([]byte, []byte, []byte, error) {
  
  	err := ctxutil.ErrIfDone(ctx)
  	if err != nil {
  		return nil, nil, nil, err
  	}
  
  	nonces := make([]byte, 48)
  	_, err = rand.Read(nonces)
  	if err != nil {
  		return nil, nil, nil, err
  	}
  
  	cekNonce := nonces[:24]
  	nonce := [24]byte{}
  	copy(nonce[:], nonces[24:])
  
  	mek, err := e.Unbox(ctx, encMec, mecNonce, privKP, pubKey)
  	if err != nil {
  		return nil, nil, nil, err
  	}
  	defer mek.Destroy()
  
  	cek, err := deriveKey(ctx, mek.Buffer(), cekNonce, 32)
  	if err != nil {
  		return nil, nil, nil, err
  	}
  
  	cekb := [32]byte{}
  	copy(cekb[:], cek)
  
  	err = ctxutil.ErrIfDone(ctx)
  	if err != nil {
  		return nil, nil, nil, err
  	}
  
  	ct := secretbox.Seal([]byte{}, pt, &nonce, &cekb)
  	return cekNonce, nonce[:], ct, err
  }
docs: // BoxCredential encrypts the credential value pt via symmetric secretbox
  // encryption.
  //
  // Doing so is a multistep process.
  // First we use the user's session data to unseal their private encryption key.
  // With their encryption key and the public encryption key provided, we can
  // decrypt the keyring master key (mek).
  // Using mek and a generated nonce, we derive the credential encryption key
  // (cek) via blake2b.
  // Finally, we use the cek and a generated nonce to encrypt the credential.
  //
  // BoxCredential returns the nonce generated to derive the credential
  // encryption key,  the nonce generated for encrypting the credential, and the
  // encrypted credential.