code: func (n NACLSecretbox) Encrypt(data []byte) (*api.MaybeEncryptedRecord, error) {
  	var nonce [24]byte
  	if _, err := io.ReadFull(cryptorand.Reader, nonce[:]); err != nil {
  		return nil, err
  	}
  
  	// Seal's first argument is an "out", the data that the new encrypted message should be
  	// appended to.  Since we don't want to append anything, we pass nil.
  	encrypted := secretbox.Seal(nil, data, &nonce, &n.key)
  	return &api.MaybeEncryptedRecord{
  		Algorithm: n.Algorithm(),
  		Data:      encrypted,
  		Nonce:     nonce[:],
  	}, nil
  }
docs: // Encrypt encrypts some bytes and returns an encrypted record