code: func (f Fernet) Encrypt(data []byte) (*api.MaybeEncryptedRecord, error) {
  	out, err := fernet.EncryptAndSign(data, &f.key)
  	if err != nil {
  		return nil, err
  	}
  	// fernet generates its own IVs, so nonce is empty
  	return &api.MaybeEncryptedRecord{
  		Algorithm: f.Algorithm(),
  		Data:      out,
  	}, nil
  }
docs: // Encrypt encrypts some bytes and returns an encrypted record