https://blog.dejavu.moe/posts/hugo-protected-leaf-bundle-encryption/