code: func NewRaftDEKManager(kw ca.KeyWriter, fips bool) (*RaftDEKManager, error) {
  	// If there is no current DEK, generate one and write it to disk
  	err := kw.ViewAndUpdateHeaders(func(h ca.PEMKeyHeaders) (ca.PEMKeyHeaders, error) {
  		dekData, ok := h.(RaftDEKData)
  		// it wasn't a raft DEK manager before - just replace it
  		if !ok || dekData.CurrentDEK == nil {
  			return RaftDEKData{
  				EncryptionKeys: raft.EncryptionKeys{
  					CurrentDEK: encryption.GenerateSecretKey(),
  				},
  				FIPS: fips,
  			}, nil
  		}
  		return nil, errNoUpdateNeeded
  	})
  	if err != nil && err != errNoUpdateNeeded {
  		return nil, err
  	}
  	return &RaftDEKManager{
  		kw:         kw,
  		FIPS:       fips,
  		rotationCh: make(chan struct{}, 1),
  	}, nil
  }
docs: // NewRaftDEKManager returns a RaftDEKManager that uses the current key writer
  // and header manager