Function seal_pdu 

fn seal_pdu(
    session_id: u64,
    enc_keys: ([u8; 32], [u8; 32]),
    cipher: u16,
    msg: &[u8],
) -> Option<Vec<u8>>

Seal msg into a transform frame with explicit key material so both the request path and background async tasks can encrypt without borrowing the whole connection.