code: func (r RaftDEKData) UpdateKEK(oldKEK, candidateKEK ca.KEKData) ca.PEMKeyHeaders {
  	if _, unlockedToLocked, err := compareKEKs(oldKEK, candidateKEK); err == nil && unlockedToLocked {
  		return RaftDEKData{
  			EncryptionKeys: r.EncryptionKeys,
  			NeedsRotation:  true,
  			FIPS:           r.FIPS,
  		}
  	}
  	return r
  }
docs: // UpdateKEK sets NeedRotation to true if we go from unlocked to locked.