  	return path.Join(k.dir, "sealed_keyset")
  }
  
- // DelegationPath returns the path for a stored signing key.
+-// DelegationPath returns the path for a stored signing key.
++// DelegationPath returns the path for a stored delegation.
  func (k *Keys) DelegationPath() string {
  	if k.dir == "" {
  		return ""

 	if err != nil {
 		return nil, err
 	}
 	defer zeroBytes(m)
 
@@ -172,52 +171,50 @@ func (lh *LinuxHost) Seal(child *LinuxHostChild, data []byte, policy string) ([]
 
 // Unseal decrypts data for the child, but only if the policy is satisfied.
 func (lh *LinuxHost) Unseal(child *LinuxHostChild, sealed []byte) ([]byte, string, error) {

 	if err != nil {
 		return nil, "", err
 	}
-	defer zeroBytes(decrypted)
+	defer ZeroBytes(decrypted)
 
 	var lhsb LinuxHostSealedBundle
 	if err := proto.Unmarshal(decrypted, &lhsb); err != nil {
