code: func encrypt(key []byte, plaintext []byte, additionalData []byte) ([]byte, []byte, error) {
  	block, err := aes.NewCipher(key)
  	if err != nil {
  		return nil, nil, err
  	}
  	aesgcm, err := cipher.NewGCM(block)
  	nonce := make([]byte, aesgcm.NonceSize())
  	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
  		return nil, nil, err
  	}
  	if err != nil {
  		return nil, nil, err
  	}
  	ciphertext := aesgcm.Seal(nil, nonce, plaintext, additionalData)
  	return ciphertext, nonce, nil
  }
docs: // encrypt encrypts plaintext with the given key, with additional data
  // The 'additionalData' is used to place the (plaintext) KV-store key into the V,
  // to prevent the possibility to alter a K, or swap two entries in the KV store with eachother.