code: func (e *Engine) ChangePassword(ctx context.Context, newPassword string) (*primitive.UserPassword, *primitive.MasterKey, *primitive.LoginPublicKey, error) {
  	// We need to re-use the master key
  	cmk, err := e.unsealMasterKey(ctx)
  	defer cmk.Destroy()
  	if err != nil {
  		return nil, nil, nil, err
  	}
  
  	// Encrypt the new password and re-encrypt the original master key
  	b := cmk.Buffer()
  	pw, master, err := EncryptPasswordObject(ctx, newPassword, &b)
  	if err != nil {
  		return nil, nil, nil, err
  	}
  
  	// Now derive LoginKeypair
  	s, err := base64.NewFromString(pw.Salt)
  	if err != nil {
  		return nil, nil, nil, err
  	}
  
  	keypair, err := DeriveLoginKeypair(ctx, []byte(newPassword), s)
  	if err != nil {
  		return nil, nil, nil, err
  	}
  
  	return pw, master, &primitive.LoginPublicKey{
  		Salt:  keypair.Salt(),
  		Value: keypair.PublicKey(),
  		Alg:   EdDSA,
  	}, nil
  }
docs: // ChangePassword creates a password object and re-encrypts the master key