code: func (k *KeyReadWriter) readKey() (*pem.Block, error) {
  	keyBlock, err := k.readKeyblock()
  	if err != nil {
  		return nil, err
  	}
  
  	if !keyutils.IsEncryptedPEMBlock(keyBlock) {
  		return keyBlock, nil
  	}
  
  	// If it's encrypted, we can't read without a passphrase (we're assuming
  	// empty passphrases are invalid)
  	if k.kekData.KEK == nil {
  		return nil, ErrInvalidKEK{Wrapped: x509.IncorrectPasswordError}
  	}
  
  	derBytes, err := k.keyFormatter.DecryptPEMBlock(keyBlock, k.kekData.KEK)
  	if err == keyutils.ErrFIPSUnsupportedKeyFormat {
  		return nil, err
  	} else if err != nil {
  		return nil, ErrInvalidKEK{Wrapped: err}
  	}
  
  	// change header only if its pkcs8
  	if keyBlock.Type == "ENCRYPTED PRIVATE KEY" {
  		keyBlock.Type = "PRIVATE KEY"
  	}
  
  	// remove encryption PEM headers
  	headers := make(map[string]string)
  	mergePEMHeaders(headers, keyBlock.Headers)
  
  	return &pem.Block{
  		Type:    keyBlock.Type, // the key type doesn't change
  		Bytes:   derBytes,
  		Headers: headers,
  	}, nil
  }
docs: // readKey returns the decrypted key pem bytes, and enforces the KEK if applicable
  // (writes it back with the correct encryption if it is not correctly encrypted)