code: func (k *KeyReadWriter) writeKey(keyBlock *pem.Block, kekData KEKData, pkh PEMKeyHeaders) error {
  	if kekData.KEK != nil {
  		encryptedPEMBlock, err := k.keyFormatter.EncryptPEMBlock(keyBlock.Bytes, kekData.KEK)
  		if err != nil {
  			return err
  		}
  		if !keyutils.IsEncryptedPEMBlock(encryptedPEMBlock) {
  			return errors.New("unable to encrypt key - invalid PEM file produced")
  		}
  		keyBlock = encryptedPEMBlock
  	}
  
  	if pkh != nil {
  		headers, err := pkh.MarshalHeaders(kekData)
  		if err != nil {
  			return err
  		}
  		mergePEMHeaders(keyBlock.Headers, headers)
  	}
  	keyBlock.Headers[versionHeader] = strconv.FormatUint(kekData.Version, 10)
  
  	if err := ioutils.AtomicWriteFile(k.paths.Key, pem.EncodeToMemory(keyBlock), keyPerms); err != nil {
  		return err
  	}
  	k.kekData = kekData
  	k.headersObj = pkh
  	return nil
  }
docs: // writeKey takes an unencrypted keyblock and, if the kek is not nil, encrypts it before
  // writing it to disk.  If the kek is nil, writes it to disk unencrypted.