code: func (k Key) Seal(plaintext []byte) ([]byte, error) {
  	block, err := aes.NewCipher([]byte(k))
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	aesgcm, err := cipher.NewGCM(block)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	nonce := make([]byte, aesgcm.NonceSize())
  	_, err = io.ReadFull(rand.Reader, nonce)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	ciphertext, err := json.Marshal(&sealedData{
  		Ciphertext: aesgcm.Seal(nil, nonce, plaintext, nil),
  		Nonce:      nonce,
  	})
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	return ciphertext, nil
  }
docs: // Seal will encrypt then authenticate the ciphertext.