func loadAndEncryptCert(certPath string, key []byte) ([]byte, error) {
	cert, err := os.ReadFile(certPath)
	if err != nil {
		return nil, err
	}
	return cryptoutil.EncryptBytes(cert, key)
}

func certsToTransfer(cfg *kubeadmapi.InitConfiguration) map[string]string {
	certsDir := cfg.CertificatesDir
	certs := map[string]string{
		kubeadmconstants.CACertName:                   filepath.Join(certsDir, kubeadmconstants.CACertName),