code: func compareKEKs(oldKEK, candidateKEK ca.KEKData) (bool, bool, error) {
  	keksEqual := subtle.ConstantTimeCompare(oldKEK.KEK, candidateKEK.KEK) == 1
  	switch {
  	case oldKEK.Version == candidateKEK.Version && !keksEqual:
  		return false, false, fmt.Errorf("candidate KEK has the same version as the current KEK, but a different KEK value")
  	case oldKEK.Version >= candidateKEK.Version || keksEqual:
  		return false, false, nil
  	default:
  		return true, oldKEK.KEK == nil, nil
  	}
  }
docs: // Returns whether the old KEK should be replaced with the new KEK, whether we went from
  // unlocked to locked, and whether there was an error (the versions are the same, but the
  // keks are different)