The nonce value is not read by anything, and di.sharedKey.Seal() a few lines below generates its own. #cleanup Signed-off-by: salman <salman@tailscale.com>