code: func (k *KeyReadWriter) Write(certBytes, plaintextKeyBytes []byte, kekData *KEKData) error {
  	k.mu.Lock()
  	defer k.mu.Unlock()
  
  	// current assumption is that the cert and key will be in the same directory
  	if err := os.MkdirAll(filepath.Dir(k.paths.Key), 0755); err != nil {
  		return err
  	}
  
  	// Ensure that we will have a keypair on disk at all times by writing the cert to a
  	// temp path first.  This is because we want to have only a single copy of the key
  	// for rotation and header modification.
  	tmpPaths := k.genTempPaths()
  	if err := ioutils.AtomicWriteFile(tmpPaths.Cert, certBytes, certPerms); err != nil {
  		return err
  	}
  
  	keyBlock, _ := pem.Decode(plaintextKeyBytes)
  	if keyBlock == nil {
  		return errors.New("invalid PEM-encoded private key")
  	}
  
  	if kekData == nil {
  		kekData = &k.kekData
  	}
  	pkh := k.headersObj
  	if k.headersObj != nil {
  		pkh = k.headersObj.UpdateKEK(k.kekData, *kekData)
  	}
  
  	if err := k.writeKey(keyBlock, *kekData, pkh); err != nil {
  		return err
  	}
  	return os.Rename(tmpPaths.Cert, k.paths.Cert)
  }
docs: // Write attempts write a cert and key to text.  This can also optionally update
  // the KEK while writing, if an updated KEK is provided.  If the pointer to the
  // update KEK is nil, then we don't update. If the updated KEK itself is nil,
  // then we update the KEK to be nil (data should be unencrypted).