A lot of the hardest problems in practical cryptography come down less to the abstractions around literally encrypting and decrypting things and more around the secure management of key material to ensure that the application supports things like online key rotation and makes it easy to verify that keys are being generated, serialized, and stored securely, and addressing the "First Secret" problem. If you're wanting to learn to use cryptography by developing an abstraction over stdlib cryptographic APIs, I would encourage you to find solutions to those problems.

Another source of inspiration (and something I use in production) is the Tink family of cryptographic libraries by Google [1]. Their Go implementation [2] is not without its warts, but it's very difficult to run into any of those security bugs that exist around cryptography. Where the Go documentation lacks, there are some examples in the developer docs that help fill some of the gaps [3] [4].

The documentation isn't 100% complete, but I find it more discoverable than the standard library because while the standard library requires you to read both `crypto/cipher` and `crypto/aes` or `golang.org/x/crypto/chacha20poly1305` depending on what kind of cipher you want, Tink organizes it by use cases [5] and generally groups together all the things you need to do cryptographic operations under the use-case-named interfaces in the `tink` package [6], with the corresponding key generation templates located under the top-level packages of the same name [7].

[1]: https://developers.google.com/tink

[2]: https://github.com/tink-crypto/tink-go/

[3]: https://developers.google.com/tink/key-management-overview#g...

[4]: https://developers.google.com/tink/encrypt-data#go

[5]: https://developers.google.com/tink/choose-primitive

[6]: https://pkg.go.dev/github.com/tink-crypto/tink-go/v2/tink#AE...

[7]: https://pkg.go.dev/github.com/tink-crypto/tink-go/v2@v2.4.0/...