code: func (r *RaftDEKManager) MaybeUpdateKEK(candidateKEK ca.KEKData) (bool, bool, error) {
  	var updated, unlockedToLocked bool
  	err := r.kw.ViewAndRotateKEK(func(currentKEK ca.KEKData, h ca.PEMKeyHeaders) (ca.KEKData, ca.PEMKeyHeaders, error) {
  		var err error
  		updated, unlockedToLocked, err = compareKEKs(currentKEK, candidateKEK)
  		if err == nil && !updated { // if we don't need to rotate the KEK, don't bother updating
  			err = errNoUpdateNeeded
  		}
  		if err != nil {
  			return ca.KEKData{}, nil, err
  		}
  
  		data, ok := h.(RaftDEKData)
  		if !ok {
  			return ca.KEKData{}, nil, errNotUsingRaftDEKData
  		}
  
  		if unlockedToLocked {
  			data.NeedsRotation = true
  		}
  		return candidateKEK, data, nil
  	})
  	if err == errNoUpdateNeeded {
  		err = nil
  	}
  
  	if err == nil && unlockedToLocked {
  		r.rotationCh <- struct{}{}
  	}
  	return updated, unlockedToLocked, err
  }
docs: // MaybeUpdateKEK does a KEK rotation if one is required.  Returns whether
  // the kek was updated, whether it went from unlocked to locked, and any errors.