// one for the source and one for the target. This reader is the source.
	var ssecClientKey []byte
	if crypto.SSEC.IsEncrypted(oi.UserDefined) {
		if copySource && crypto.SSECopy.IsRequested(h) {
			key, err := crypto.SSECopy.ParseHTTP(h)
			if err != nil {
				return nil, err
			}
			ssecClientKey = key[:]
		} else {
			key, err := crypto.SSEC.ParseHTTP(h)
			if err != nil {
				return nil, err