code: function rsaOaepEncrypt(cek, key) {
    if (key instanceof Buffer) {
      key = key.toString();
    } else if (typeof key !== 'string') {
      throw new TypeError('Key must be a buffer or a string');
    }
    if (!key.includes('-----BEGIN') ||
        !(key.includes('KEY-----') || key.includes('CERTIFICATE-----'))) {
      throw new TypeError('Key must be a PEM formatted RSA public key');
    }
    let options = {key: key, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING};
    return buf2b64url(crypto.publicEncrypt(options, cek));
  }
docs: ===== RSA-OAEP =============================================================