code: func (e *Engine) Box(ctx context.Context, pt *secure.Secret, privKP *EncryptionKeyPair,
  	pubKey []byte) ([]byte, []byte, error) {
  
  	err := ctxutil.ErrIfDone(ctx)
  	if err != nil {
  		return nil, nil, err
  	}
  
  	nonce := [24]byte{}
  	_, err = rand.Read(nonce[:])
  	if err != nil {
  		return nil, nil, err
  	}
  
  	privKey, err := e.Unseal(ctx, privKP.Private, privKP.PNonce)
  	if err != nil {
  		return nil, nil, err
  	}
  	defer privKey.Destroy()
  
  	// Get a pointer to the underlying private key in memory
  	privkb := (*[32]byte)(unsafe.Pointer(&privKey.Buffer()[0]))
  
  	pubkb := [32]byte{}
  	copy(pubkb[:], pubKey)
  
  	err = ctxutil.ErrIfDone(ctx)
  	if err != nil {
  		return nil, nil, err
  	}
  
  	return box.Seal([]byte{}, pt.Buffer(), &nonce, &pubkb, privkb), nonce[:], nil
  }
docs: // Box encrypts the plaintext pt bytes with Box, using the private key found in
  // privKP, first decrypted with the user's master key, and encrypted for the
  // public key pubKey.
  //
  // It returns the ciphertext, the nonce used for encrypting the plaintext,
  // and an optional error.