code: func (r *RaftDEKManager) UpdateKeys(newKeys raft.EncryptionKeys) error {
  	return r.kw.ViewAndUpdateHeaders(func(h ca.PEMKeyHeaders) (ca.PEMKeyHeaders, error) {
  		data, ok := h.(RaftDEKData)
  		if !ok {
  			return nil, errNotUsingRaftDEKData
  		}
  		// If there is no current DEK, we are basically wiping out all DEKs (no header object)
  		if newKeys.CurrentDEK == nil {
  			return nil, nil
  		}
  		return RaftDEKData{
  			EncryptionKeys: newKeys,
  			NeedsRotation:  data.NeedsRotation,
  			FIPS:           data.FIPS,
  		}, nil
  	})
  }
docs: // UpdateKeys will set the updated encryption keys in the headers.  This finishes
  // a rotation, and is expected to set the CurrentDEK to the previous PendingDEK.