code: func encrypt(plaintext, key, nonce []byte, encoding ContentEncoding) ([]byte, error) {
  	var data []byte
  	if encoding == AES128GCM {
  		// The padding delimiter octet MUST be checked, values other than 0x02 MUST
  		// cause the message to be discarded.
  		// See here for more details for restrictions on use of "aes128gcm":
  		// https://tools.ietf.org/html/draft-ietf-webpush-encryption-08#section-4
  		data = append(plaintext, []byte{0x02}...)
  	} else {
  		// Add padding. There is a uint16 size followed by that number of bytes of
  		// padding.
  		// TODO: Right now we leave the size at zero. We should add a padding option
  		// that allows the payload size to be obscured.
  		data = append([]byte{0, 0}, plaintext...)
  	}
  	c, err := aes.NewCipher(key)
  	if err != nil {
  		return nil, err
  	}
  	gcm, err := cipher.NewGCM(c)
  	if err != nil {
  		return nil, err
  	}
  
  	return gcm.Seal([]byte{}, nonce, data, nil), nil
  }
docs: // Encrypt the plaintext message using AES128/GCM