code: func (r RaftDEKData) MarshalHeaders(kekData ca.KEKData) (map[string]string, error) {
  	headers := make(map[string]string)
  	for headerKey, contents := range map[string][]byte{
  		pemHeaderRaftDEK:        r.CurrentDEK,
  		pemHeaderRaftPendingDEK: r.PendingDEK,
  	} {
  		if contents != nil {
  			dekStr, err := encodePEMHeaderValue(contents, kekData.KEK, r.FIPS)
  			if err != nil {
  				return nil, err
  			}
  			headers[headerKey] = dekStr
  		}
  	}
  
  	if r.NeedsRotation {
  		headers[pemHeaderRaftDEKNeedsRotation] = "true"
  	}
  
  	// return a function that updates the dek data on write success
  	return headers, nil
  }
docs: // MarshalHeaders returns new PEM headers given the current KEK - it uses the current KEK to
  // serialize/encrypt the current DEK state that is maintained in the current RaftDEKData object.