func (kw *pkcs11KeyWrapper) WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error) {
	pkcs11Recipients, err := addPubKeys(&ec.DecryptConfig, append(ec.Parameters["pkcs11-pubkeys"], ec.Parameters["pkcs11-yamls"]...))
	if err != nil {
		return nil, err
	}
	if len(pkcs11Recipients) == 0 {
		return nil, nil
	}
	jsonString, err := pkcs11.EncryptMultiple(pkcs11Recipients, optsData)
	if err != nil {
		return nil, errors.Wrapf(err, "PKCS11 EncryptMulitple failed")
	}
	return jsonString, nil
}
WrapKeys wraps the session key for recpients and encrypts the optsData, which
describe the symmetric key used for encrypting the layer
package pkcs11
import (
	"github.com/containers/ocicrypt/config"
	"github.com/containers/ocicrypt/crypto/pkcs11"
	"github.com/containers/ocicrypt/keywrap"
	"github.com/containers/ocicrypt/utils"
	"github.com/pkg/errors"
)
type pkcs11KeyWrapper struct {
}
func (kw *pkcs11KeyWrapper) GetAnnotationID() string {
	return "org.opencontainers.image.enc.keys.pkcs11"
}
func NewKeyWrapper() keywrap.KeyWrapper {
	return &pkcs11KeyWrapper{}
}