code: func Seal(out, message []byte, nonce nacl.Nonce, key nacl.Key) []byte {
  	subKey, counter := nacl.Setup(nonce, key)
  
  	// The Poly1305 key is generated by encrypting 32 bytes of zeros. Since
  	// Salsa20 works with 64-byte blocks, we also generate 32 bytes of
  	// keystream as a side effect.
  	var firstBlock [64]byte
  	salsa.XORKeyStream(firstBlock[:], firstBlock[:], counter, subKey)
  
  	var poly1305Key [32]byte
  	copy(poly1305Key[:], firstBlock[:])
  
  	ret, out := sliceForAppend(out, len(message)+onetimeauth.Size)
  	if subtle.AnyOverlap(out, message) {
  		panic("nacl: invalid buffer overlap")
  	}
  
  	// We XOR up to 32 bytes of message with the keystream generated from
  	// the first block.
  	firstMessageBlock := message
  	if len(firstMessageBlock) > 32 {
  		firstMessageBlock = firstMessageBlock[:32]
  	}
  
  	tagOut := out
  	out = out[onetimeauth.Size:]
  	for i, x := range firstMessageBlock {
  		out[i] = firstBlock[32+i] ^ x
  	}
  	message = message[len(firstMessageBlock):]
  	ciphertext := out
  	out = out[len(firstMessageBlock):]
  
  	// Now encrypt the rest.
  	counter[8] = 1
  	salsa.XORKeyStream(out, message, counter, subKey)
  
  	tag := onetimeauth.Sum(ciphertext, &poly1305Key)
  	copy(tagOut, tag[:])
  
  	return ret
  }
docs: // Seal appends an encrypted and authenticated copy of message to out, which
  // must not overlap message. The key and nonce pair must be unique for each
  // distinct message and the output will be Overhead bytes longer than message.