func (kw *gpgKeyWrapper) UnwrapKey(dc *config.DecryptConfig, pgpPacket []byte) ([]byte, error) {
	pgpPrivateKeys, pgpPrivateKeysPwd, err := kw.getKeyParameters(dc.Parameters)
	if err != nil {
		return nil, err
	}
	for idx, pgpPrivateKey := range pgpPrivateKeys {
		r := bytes.NewBuffer(pgpPrivateKey)
		entityList, err := openpgp.ReadKeyRing(r)
		if err != nil {
			return nil, errors.Wrap(err, "unable to parse private keys")
		}
		var prompt openpgp.PromptFunction
		if len(pgpPrivateKeysPwd) > idx {
			responded := false
			prompt = func(keys []openpgp.Key, symmetric bool) ([]byte, error) {
				if responded {
					return nil, fmt.Errorf("don't seem to have the right password")
				}
				responded = true
				for _, key := range keys {
					if key.PrivateKey != nil {
						_ = key.PrivateKey.Decrypt(pgpPrivateKeysPwd[idx])
					}
				}
				return pgpPrivateKeysPwd[idx], nil
			}
		}
		r = bytes.NewBuffer(pgpPacket)
		md, err := openpgp.ReadMessage(r, entityList, prompt, GPGDefaultEncryptConfig)
		if err != nil {
			continue
		}
		optsData, err := ioutil.ReadAll(md.UnverifiedBody)
		if err != nil {
			continue
		}
		return optsData, nil
	}
	return nil, errors.New("PGP: No suitable key found to unwrap key")
}
UnwrapKey unwraps the symmetric key with which the layer is encrypted
This symmetric key is encrypted in the PGP payload.
package pgp
import (
	"bytes"
	"crypto"
	"crypto/rand"
	"encoding/base64"
	"fmt"
	"io"
	"io/ioutil"
	"net/mail"
	"strconv"
	"strings"
	"github.com/containers/ocicrypt/config"
	"github.com/containers/ocicrypt/keywrap"
	"github.com/pkg/errors"
	"golang.org/x/crypto/openpgp"
	"golang.org/x/crypto/openpgp/packet"
)
type gpgKeyWrapper struct {
}
func NewKeyWrapper() keywrap.KeyWrapper {
	return &gpgKeyWrapper{}
}
var (
	GPGDefaultEncryptConfig = &packet.Config{
		Rand:              rand.Reader,
		DefaultHash:       crypto.SHA256,
		DefaultCipher:     packet.CipherAES256,
		CompressionConfig: &packet.CompressionConfig{Level: 0},  
		RSABits:           2048,
	}
)
func (kw *gpgKeyWrapper) GetAnnotationID() string {
	return "org.opencontainers.image.enc.keys.pgp"
}
func (kw *gpgKeyWrapper) WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error) {
	ciphertext := new(bytes.Buffer)
	el, err := kw.createEntityList(ec)
	if err != nil {
		return nil, errors.Wrap(err, "unable to create entity list")
	}
	if len(el) == 0 {
		return nil, nil
	}
	plaintextWriter, err := openpgp.Encrypt(ciphertext,
		el,   
		nil,  
		nil,  
		GPGDefaultEncryptConfig)
	if err != nil {
		return nil, err
	}
	if _, err = plaintextWriter.Write(optsData); err != nil {
		return nil, err
	} else if err = plaintextWriter.Close(); err != nil {
		return nil, err
	}
	return ciphertext.Bytes(), err
}