code: func (r RaftDEKData) UnmarshalHeaders(headers map[string]string, kekData ca.KEKData) (ca.PEMKeyHeaders, error) {
  	var (
  		currentDEK, pendingDEK []byte
  		err                    error
  	)
  
  	if currentDEKStr, ok := headers[pemHeaderRaftDEK]; ok {
  		currentDEK, err = decodePEMHeaderValue(currentDEKStr, kekData.KEK, r.FIPS)
  		if err != nil {
  			return nil, err
  		}
  	}
  	if pendingDEKStr, ok := headers[pemHeaderRaftPendingDEK]; ok {
  		pendingDEK, err = decodePEMHeaderValue(pendingDEKStr, kekData.KEK, r.FIPS)
  		if err != nil {
  			return nil, err
  		}
  	}
  
  	if pendingDEK != nil && currentDEK == nil {
  		return nil, fmt.Errorf("there is a pending DEK, but no current DEK")
  	}
  
  	_, ok := headers[pemHeaderRaftDEKNeedsRotation]
  	return RaftDEKData{
  		NeedsRotation: ok,
  		EncryptionKeys: raft.EncryptionKeys{
  			CurrentDEK: currentDEK,
  			PendingDEK: pendingDEK,
  		},
  		FIPS: r.FIPS,
  	}, nil
  }
docs: // UnmarshalHeaders loads the current state of the DEKs into a new RaftDEKData object (which is returned) given the
  // current TLS headers and the current KEK.