code: func (x *XC) encryptHeader(ctx context.Context, signKey *keyring.PrivateKey, sk []byte, recipients []string) (*xcpb.Header, error) {
  	hdr := &xcpb.Header{
  		Sender:     signKey.Fingerprint(),
  		Recipients: make(map[string][]byte, len(recipients)),
  	}
  
  	recipients = append(recipients, signKey.Fingerprint())
  	sort.Strings(recipients)
  
  	for _, recp := range recipients {
  		// skip duplicates
  		if _, found := hdr.Recipients[recp]; found {
  			continue
  		}
  
  		r, err := x.encryptForRecipient(ctx, signKey, sk, recp)
  		if err != nil {
  			return nil, errors.Wrapf(err, "failed to encrypt session key for recipient %s: %s", recp, err)
  		}
  
  		hdr.Recipients[recp] = r
  	}
  
  	return hdr, nil
  }
docs: // encrypt header creates and populates a header struct with the nonce (plain)
  // and the session key encrypted per recipient