code: func (s *storage) encryptBlob(ciphertext, plaintext []byte) []byte {
  	if s.key == [32]byte{} {
  		// Safety check, we really don't want this to happen.
  		panic("no passphrase set")
  	}
  	var nonce [24]byte
  	s.randNonce(&nonce)
  	ciphertext = append(ciphertext, version)
  	ciphertext = append(ciphertext, nonce[:]...)
  	return secretbox.Seal(ciphertext, plaintext, &nonce, &s.key)
  }
docs: // encryptBlob encrypts plaintext and appends the result to ciphertext,
  // which must not overlap plaintext.