code: func (e *Entity) encryptionKey(now time.Time) (Key, bool) {
  	candidateSubkey := -1
  
  	for i, subkey := range e.Subkeys {
  		if subkey.Sig.FlagsValid &&
  			subkey.Sig.FlagEncryptCommunications &&
  			subkey.PublicKey.PubKeyAlgo.CanEncrypt() &&
  			!subkey.Sig.KeyExpired(now) {
  			candidateSubkey = i
  			break
  		}
  	}
  
  	if candidateSubkey != -1 {
  		subkey := e.Subkeys[candidateSubkey]
  		return Key{e, subkey.PublicKey, subkey.PrivateKey, subkey.Sig}, true
  	}
  
  	// If we don't have any candidate subkeys for encryption and
  	// the primary key doesn't have any usage metadata then we
  	// assume that the primary key is ok. Or, if the primary key is
  	// marked as ok to encrypt to, then we can obviously use it.
  	i := e.primaryIdentity()
  	if !i.SelfSignature.FlagsValid || i.SelfSignature.FlagEncryptCommunications &&
  		e.PrimaryKey.PubKeyAlgo.CanEncrypt() &&
  		!i.SelfSignature.KeyExpired(now) {
  		return Key{e, e.PrimaryKey, e.PrivateKey, i.SelfSignature}, true
  	}
  
  	// This Entity appears to be signing only.
  	return Key{}, false
  }
docs: // encryptionKey returns the best candidate Key for encrypting a message to the
  // given Entity.