code: func (c *controller) SetKeys(keys []*types.EncryptionKey) error {
  	subsysKeys := make(map[string]int)
  	for _, key := range keys {
  		if key.Subsystem != subsysGossip &&
  			key.Subsystem != subsysIPSec {
  			return fmt.Errorf("key received for unrecognized subsystem")
  		}
  		subsysKeys[key.Subsystem]++
  	}
  	for s, count := range subsysKeys {
  		if count != keyringSize {
  			return fmt.Errorf("incorrect number of keys for subsystem %v", s)
  		}
  	}
  
  	agent := c.getAgent()
  
  	if agent == nil {
  		c.Lock()
  		c.keys = keys
  		c.Unlock()
  		return nil
  	}
  	return c.handleKeyChange(keys)
  }
docs: // libnetwork side of agent depends on the keys. On the first receipt of
  // keys setup the agent. For subsequent key set handle the key change