code: func (x *XC) EncryptStream(ctx context.Context, plaintext io.Reader, recipients []string, ciphertext io.Writer) error {
  	privKeyIDs := x.secring.KeyIDs()
  	if len(privKeyIDs) < 1 {
  		return fmt.Errorf("no signing keys available on our keyring")
  	}
  	privKey := x.secring.Get(privKeyIDs[0])
  
  	// generate session / encryption key
  	var sessionKey [32]byte
  	if _, err := crypto_rand.Read(sessionKey[:]); err != nil {
  		return err
  	}
  
  	// encrypt the session key per recipient
  	header, err := x.encryptHeader(ctx, privKey, sessionKey[:], recipients)
  	if err != nil {
  		return errors.Wrapf(err, "failed to encrypt header: %s", err)
  	}
  
  	// create the encoder
  	enc := binary.NewEncoder(ciphertext)
  
  	// write verion
  	if err := enc.Encode(0x1); err != nil {
  		return err
  	}
  	// write header
  	if err := enc.Encode(header); err != nil {
  		return err
  	}
  	// write body
  	num := 0
  	buf := make([]byte, chunkSizeMax)
  	encbuf := make([]byte, 8)
  	for {
  		n, err := plaintext.Read(buf)
  		if err := x.encryptChunk(sessionKey, num, buf[:n], encbuf, ciphertext); err != nil {
  			return err
  		}
  		if err != nil {
  			if err == io.EOF {
  				return nil
  			}
  			return err
  		}
  		num++
  	}
  }
docs: // EncryptStream encrypts the plaintext using a slightly modified on disk-format
  // suitable for streaming