code: func (e *Engine) Unseal(ctx context.Context, ct, nonce []byte) (*secure.Secret, error) {
  	mk, err := e.unsealMasterKey(ctx)
  	defer mk.Destroy()
  	if err != nil {
  		return nil, err
  	}
  
  	dk, err := deriveKey(ctx, mk.Buffer(), nonce, blakeSize)
  	if err != nil {
  		return nil, err
  	}
  
  	ts, err := newTriplesec(ctx, dk)
  	if err != nil {
  		return nil, err
  	}
  
  	err = ctxutil.ErrIfDone(ctx)
  	if err != nil {
  		return nil, err
  	}
  
  	b, err := ts.Decrypt(ct)
  	if err != nil {
  		return nil, err
  	}
  
  	return e.guard.Secret(b)
  }
docs: // Unseal decrypts the ciphertext ct, encrypted with triplesec-v3, using the
  // a key derived via blake2b from the user's master key and the provided nonce.