code: func (u *unsealerImpl) WithUnboxer(ctx context.Context, encMec, mecNonce []byte,
  	fn func(Unboxer) error) error {
  
  	nonce := [24]byte{}
  	copy(nonce[:], mecNonce)
  
  	// Get a pointer to the private key buffer
  	privkb := (*[32]byte)(unsafe.Pointer(&u.privkey.Buffer()[0]))
  	pubkb := [32]byte{}
  	copy(pubkb[:], u.pubkey)
  
  	err := ctxutil.ErrIfDone(ctx)
  	if err != nil {
  		return err
  	}
  
  	mek, success := box.Open([]byte{}, encMec, &nonce, &pubkb, privkb)
  	if !success {
  		return errors.New("Failed to decrypt keyring")
  	}
  
  	s, err := u.engine.guard.Secret(mek)
  	if err != nil {
  		return err
  	}
  	defer s.Destroy()
  
  	unboxer := unboxerImpl{mek: s}
  	return fn(&unboxer)
  }
docs: // WithUnboxer returns an Unboxer for unboxing credentials tied to the unsealed
  // keypairs.