code: func (k *KeyringSectionV2) FindMEKByKeyID(id *identity.ID) (*primitive.MEKShare, error) {
  	var mekshare *primitive.MEKShare
  
  outerLoop:
  	for _, m := range k.Members {
  		if *m.Member.Body.EncryptingKeyID == *id {
  			// We've found the right key. Now see if this membership is
  			// unrevoked.
  			// A revocation is always terminal for a claim chain, so if there's
  			// any revocations for this membership, we know it is invalid.
  			if krmIsRevoked(m, k.Claims) {
  				continue outerLoop
  			}
  
  			if m.MEKShare == nil {
  				return nil, ErrMemberNotFound
  			}
  
  			mekshare = m.MEKShare.Body
  			break
  		}
  	}
  
  	return mekshare, nil
  }
docs: // FindMEKByKeyID returns the mekshare for the given encrypting key id.
  //
  // An owner (user/machine token) may have multiple memberships, one per
  // encryption key. There will only be one unrevoked membership. Eitgher this
  // unrevoked membership will ber returned, or the result will error with
  // ErrMemberNotFound.