code: func (r *RaftDEKManager) GetKeys() raft.EncryptionKeys {
  	var newKeys, originalKeys raft.EncryptionKeys
  	err := r.kw.ViewAndUpdateHeaders(func(h ca.PEMKeyHeaders) (ca.PEMKeyHeaders, error) {
  		data, ok := h.(RaftDEKData)
  		if !ok {
  			return nil, errNotUsingRaftDEKData
  		}
  		originalKeys = data.EncryptionKeys
  		if !data.NeedsRotation || data.PendingDEK != nil {
  			return nil, errNoUpdateNeeded
  		}
  		newKeys = raft.EncryptionKeys{
  			CurrentDEK: data.CurrentDEK,
  			PendingDEK: encryption.GenerateSecretKey(),
  		}
  		return RaftDEKData{
  			EncryptionKeys: newKeys,
  			FIPS:           data.FIPS,
  		}, nil
  	})
  	if err != nil {
  		return originalKeys
  	}
  	return newKeys
  }
docs: // GetKeys returns the current set of DEKs.  If NeedsRotation is true, and there
  // is no existing PendingDEK, it will try to create one.  If it successfully creates
  // and writes a PendingDEK, it sets NeedRotation to false.  If there are any errors
  // doing so, just return the original set of keys.