code: func (e *Engine) Seal(ctx context.Context, pt []byte) ([]byte, []byte, error) {
  	mk, err := e.unsealMasterKey(ctx)
  	defer mk.Destroy()
  	if err != nil {
  		return nil, nil, err
  	}
  
  	err = ctxutil.ErrIfDone(ctx)
  	if err != nil {
  		return nil, nil, err
  	}
  
  	nonce := make([]byte, nonceSize)
  	_, err = rand.Read(nonce)
  	if err != nil {
  		return nil, nil, err
  	}
  
  	dk, err := deriveKey(ctx, mk.Buffer(), nonce, blakeSize)
  	if err != nil {
  		return nil, nil, err
  	}
  
  	ts, err := newTriplesec(ctx, dk)
  	if err != nil {
  		return nil, nil, err
  	}
  
  	err = ctxutil.ErrIfDone(ctx)
  	if err != nil {
  		return nil, nil, err
  	}
  
  	ct, err := ts.Encrypt(pt)
  
  	return ct, nonce, err
  }
docs: // Seal encrypts the plaintext pt bytes with triplesec-v3 using a key derived
  // via blake2b from the user's master key and a nonce (returned).