mac := hmac.New(sha256.New, key[:])
	mac.Write(bin[:])
	mac.Sum(partKey[:0])
	return partKey
}

// SealETag seals the etag using the object key.
// It does not encrypt empty ETags because such ETags indicate
// that the S3 client hasn't sent an ETag = MD5(object) and
// the backend can pick an ETag value.
func (key ObjectKey) SealETag(etag []byte) []byte {

		opts := ObjectOptions{
			UserDefined: map[string]string{
				xhttp.IfMatch: "wrong-etag-12345",
			},
			HasIfMatch: true,
			CheckPrecondFn: func(oi ObjectInfo) bool {
				// Precondition fails if ETags don't match
				return oi.ETag != "wrong-etag-12345"
			},
		}

		_, err := obj.NewMultipartUpload(ctx, bucket, object, opts)
		if !isErrReadQuorum(err) {
			t.Logf("Got error (as expected): %v", err)

// A Reader wraps an io.Reader and computes the
// MD5 checksum of the read content as ETag.
//
// Optionally, a Reader can also verify that
// the computed ETag matches an expected value.
// Therefore, it compares both ETags once the
// underlying io.Reader returns io.EOF.
// If the computed ETag does not match the
// expected ETag then Read returns a VerifyError.
//
// Reader implements the Tagger interface.
type Reader struct {